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PREFACE 

Microtek International Inc. proudly presents the award winning Micro-In- 
Circuit-Emulator, MICE-II. You have made an excellent purchase and will 
soon benefit from the many advance features that Microtek designs into all 
of its products. 

With the detailed instructions provided in this manual, you can rapidly 
set up and operate your new MICE-II. The information provided in this user's 
guide is believed accurate and complete, but no responsibility is assumed 
for any error or ommision. 

Microtek is dedicated in providing leadership in the microcomputer-based 
industry. We continue to design new emulators with enhanced features, low 
cost and always geared toward the microprocessor designer's need. Thank you 
for choosing Microtek; and may we suggest that you also investigate the 
many other fine products that Microtek has to offer. 

The sale of any Microtek product is subject to all Microtek Terms and 
Conditions of Sale and Sales Policies, copies of which are available upon 
request . 

Microtek supplies a variety of hi-tech equipment to the microprocessor- 
based industry. For further information on other Microtek products and/or 
any other questions regarding this manual, please contact Microtek at the 
following location: 
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O0K)R<yreK INT£RI\KrK>l\l\L ll\K>. 

6 Industrial Road East 3 
Science-Based Industrial Park 
Hsinchu, Taiwan. 30077. R.O.C. 
TEL: (035)772155 
TLX: 32169 MICROTEK 
FAX: (035)772598 
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CHAPTER 1 
GENERAL INTRODUCTION 



1.1 Introduction To MICE 

Microtek's versatile Micro-In-Circuit-Emulator (MICE) is a low-cost develop- 
ment tool that emulates most industry-standard microprocessors. It has set 
new standards for universal, high-performance emulation, at an exceptionally- 
low cost-per-f unction. 

Traditionally, microprocessor development was done on dedicated systems. 
The computer system had its complement of peripheral devices and sufficient 
mass storage to accommodate user programs, data, etc. A dedicated emulator 
was attached to the system to assist the designer in ensuring that both 
hardware and software were functioning properly. 

Recently, a variety of general purpose computers have been designed for use 
in microprocessor development. Through the use of cross assemblers, code 
can be generated for the target system. However, these emulators are still 
dedicated to the particular computer. 

With MICE, a third and more practical approach to microprocessor develop- 
ment is now available; one that uses fewer resources, performs most of the 
same functions, yet costs only a fraction compared with its predecessors. 
The MICE module is controlled via an RS-232C compatible interface. All soft- 
ware required to operate the MICE module are contained in EPROMs within the 
module. MICE can be operated by using a display terminal only or in conjunc- 
tion with a computer system. Different processors can be emulated by merely 
changing the personality card and associated EPROMs. 
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Some key features of MICE are: 

* Operation at speeds up to the maximum rated frequency of the specified 
microprocessor , 

* Target processor retains its entire memory and I/O space. 

* Enabling and disabling of hardware control signals to the processor with 
console commands . 

* Resident assembler and two-pass disassembler which assigns labels to 
subroutine and branch addresses. 

* Built-in memory diagnostics and block memory transfer for target processor 
memory . 

* Downloading and uploading of target program between MICE and host computer 
system. 

* Help command that lists all commands along with the proper syntax. 
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1.2 Introduction to MICE-II 



1.2.1 Enhanced Features 

MICE-II is an enhanced member of the MICE family. Aside from retaining the 
original MICE features, MICE-II has substantially been upgraded to include 
the following new features: 

* High Performance Universal Emulation Memory (HUEM) with memory size 
selectable at 64K or 128K bytes {2 independent 64K settings) of static RAM 
for 8-bit MICE-II models (user must specify if required for 
microcontroller versions) . 

NOTE: Microtek continues to provide product support to earlier models of 
MICE models equipped with the 32K Universal Emulation Memory (UEM) 
board. Users may however, update these old models into expanded 
memory version by replacing UEM with HUEM board. 

* Emulation memory expandable in 64K/128K byte increments up to 256K bytes 

bi7 tries r>£il t/ ar\r\n r\cr WTTT7M Koi^t^'^Q 

* 8k byte block enable/disable capability. 

* User-qualified trigger to specify start or end of tracing for source code 
and machine statuses. Up to 2048 cycles and 40 channels of signals may be 
recorded for program debug. 

* Supports up to 8 hardware trace points for program debug. 

* Realtime forward and backward trace for up to 2048 machine cycles. 

* Two realtime breakpoints. 

* Supports disassembly for both Instruction Step and List Trace commands. 

1.2.2 New Breakpoint Processor (Optional) 

MICE-II may also be equipped with the new Breakpoint Processor (BPP) board 
at user's option. The BPP board (see Appendix M for more details) will allow 
the MICE-II to provide more advanced features as summarized below: 

* Sophisticated breakpoint logic, with up to 120 new breakpoint constructs. 

* Flexible trigger constructs that can define single events, multiple acti- 
vities or external hardware signals. 
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* Two data breakpoints and two external hardware breakpoints. 

* Breakpoint interval timer that displays the interval between Initial 
trigger and emulation stops. 



1.2.3 Major Hardware Overview 

MICE-II is a low-cost powerful emulation instrument basically equipped with 
the following boards: 

Control Emulation Processor (CEP) - also called personality board 

Realtime Trace (RTT) 

Hi^ Performance Universal Emulation Memory (HUEM) - also called memory board 

Remember that the CEP board can be interchanged to form any other MICE-II. 
If more emulation memory is needed, additional HUEM boards may be added. And 
where more powerful emulation breakpoint or triggering capability is re- 
quired, the BPP board is available. 

1.2.4 Conclusion 

At half the cost of competitive units, MICE-II provides features not availa- 
ble with other emulators. Some of the advantages of MICE-II over other 
emulators are; 



universality 



versatility 



flexibility 



A wide variety of microprocessors can be emulated using this 
single development tool, thus avoiding both the inflexibility 
of dedicated systems and the heavy capital investment required 
for general purpose systems. 

Emulation of a different processor only requires changing the 
personality board. Multiple design projects can be carried out 
concurrently, and the CEP board can be reused for different 
projects. 

With MICE-II providing its own resident assembler and disas- 
sembler, it can be minimally configured with just a display 
terminal and power supply. After the target program has been 
downloaded from the host computer, testing can be done off- 
line, thereby freeing the computer. 
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1.3 MICE-II Operating Configurations 

MICE-II can be used in several cof igurations . The simplest configuration 
requires only an RS-232C compatible terminal as the display console and 
command entry device. A computer system can also be configured as the con- 
trolling device. 



RS-232C I MICE-II I Emulation | Target | 

Cable I I Cable | System | 



I DC Power | 
I Supply I 



Figure 1-1 
Configuring MICE-II with an RS-232C Compatible Terminal or Host Computer 

When a computer system is interfaced with MICE-II, a driver program must be 
resident in the system. Driver programs and symbolic translator drivers are 
available for various systems. {See Appendix E for a detailed listing.) 

Microtek has access to various sources of driver programs and other software 
tools. For updated information contact your local Microtek representative. 
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1.3.1 Microtek Personal Development System (MPDS) 

MPDS is a fully integrated development system. It provides advanced support 
for all MICE-II emulators. Cross-assemblers, linkers and advanced software 
are just a few of its major features. Symbolic debug, logic state analysis, 
software performance analysis, emulation and interface utilities make up a 
rich software base. 

A wide variety of development and debugging tools guarantee maximum per- 
formance. The extended assembler and linker supports a powerful set of macro 
commands and generation of symbol table files. MPDS has a large internal 
memory, dual disk drives and a high resolution CRT. MPDS supports comprehen- 
sive development and debugging with these powerful functions: 



* XASM and Linker 

* Emulation 

* MICE Utilities 



* Symbolic Debug 

* Software Performance Analysis 



Logic State Analysis 



The MPDS-MS/DOS software package is fully compatible with the IBM-PC/XT/ AT. 
All the power and flexibility required for target system hardware debug, 
signal analysis {including waveform display), and software analysis makes 
MPDS a truly advanced micro -development solution. 




Figure 1-2 
Overview of MPDS Software Environment 
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1.4 MICE-II Applications 

Because of its unique design, MICE-II offers new applications which include: 

1) Inexpensive evaluation of new microprocessors without purchasing a spe- 
cial evaluation board or expensive development system. 

2) Several designers can share the use of a single development system, 
eliminating the difficult problem of allocating a single resource and the 
need for multiple work-stations. Large programs can be edited, assembled 
or compiled, and then downloaded to the target system. Since MICE-II has 
its own assembler and disassembler, the programs can then be tested using 
only a display terminal. 

3) MICE-II 's compact size, light weight, and rugged construction makes it an 
ideal field service instrument. Easily transported and set up in remote 
locations, MICE-II can reduce downtime, provide on the spot diagnosis and 
resolution of field problems, avoiding customer inconvenience and expen- 
sive service delays. With its RS-232C interface, MICE-II can be quickly 
interfaced with any compatible display terminal. Diagnostic programs can 
be generated using the resident assembler. 

4) Personal computers can be upgraded to development systems at a fraction 
of the typical costs. Driver programs for various computers have already 
been written, allowing programs assembled or compiled to be downloaded. 
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1.5 MICE-II Definitions 

MICE is a patented trade name for Microtek emulators and stands 

for Micro-In-Circuit-Emulator. 

ICE cable is an In-Circuit-Emulator cable that joins MICE-II to the 
target . 

MICE-II module is a conventional MICE emulator module consisting of three 
interconnected printed circuit boards. These boards are: 

1) Control Emulation Processor (CEP) board. 

2) Realtime Trace (RTT) board. 

3) High Performance Emulation Memory (HUEM) board. 

4) Breakpoint Processor (BPP) Board, which may be optionally 
included depending on the user's specifications. 
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CHAPTER 2 
MICE-II INSTALLATION PROCEDURES 



MICE-II comes from the factory preset and completely assembled. The MICE-II 
module consists of three printed circuit boards: Control Emulation Processor 
board (CEP) , Realtime Trace board (RTT) and High Performance Universal Emu- 
lation Memory board (HUEM) . ICE cables are also included which must be con- 
nected between MICE-II and the target system. 



2.1 Setting Up MICE-II 

Detailed instructions for setting up the MICE-II module are as follows: 

2.1.1 Opening the MICE-II Case 

MICE-II is contained in a two piece high impact plastic case. To open the 
case, hold the lower portion of the vertical end (rear) firmly with both 
hands and with your thumbs slide the top half forward about one half inch. 
This will separate the top from the bottom half. 




CEP 




BPP{Optionall 

RTT 

HUEM 



Figure 2-1 
Opening the MICE-II Case 
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2.1.2 Changing the Personality Board (CEP) or Emulation CPU 

1) To install a personality board in place of the current card, the cover of 
the MICE-II case must first be removed. With power off, carefully remove 
the top personality card (CEP) from the MICE-II module by disconnecting 
the two ribbon cable connectors which join the CEP board to the RTT board 
below, and then removing the six locking screws and six brass spacers. 

Install the new personality board into the module by refastening the 
brass spacers and locking screws to hold the replacement card permanently 
in position. Then reconnect the two ribbon cable connectors from the RTT 
board below to the CEP board; the arrows indicating pin 1 must be aligned. 

2) Only one of the applicable CPU's is supplied with each MICE-II in accord- 
ance with customer's specified emulation requirements at the time of pur- 
chase. To emulate processors other than the supplied one, change the CPU 
as required with relevant processor at locations indicated below: 



MICE-II 


CPU Location 


Z80 


Z80/Z80A/Z80B/Z80H U36 


NSC800 


NSC800 U24 


Z8 


Z8612 U38 


ZSB 


Z8883 U42 



* CPU alteration applicable to Z80 only. 

2.1.3 Internal Adjustments 

Access to all adjustment switches is possible with the MICE-II cover removed. 
The DIP switch on the personality board is readily accessed from the top; 
and the three DIP switches for memory board selection are located in the 
opening at the end of the MICE-II case, which results when the cover is 
removed. Preset instructions are explained in the following sections of this 
chapter. 

2.1 A Memory Expansion (Adding HUEM Boards) 

Instructions for adding memory boards are detailed in Appendix F. 
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2.1.5 Connecting the ICE Cable 

1) Connecting the ICE Gable for MICE-II Z80 and NSC800 

The ICE (In-Circuit-Emulator) cable assembly consists of one flat-wire cable 
with a 40-pin connector at one end and an IC header at the other end. To 
install the ICE cable after setup has been completed, remove the cover to 
MICE-II, and attach the 40-pin connector at position J5 on the CEP board. 
Thread the IC header end through the rectangular opening in the MICE-II case 
and slide the cover shut (section 2.1,7). Then attach the end with the IC 
header to the 40-pin target processor socket on the target board. (Note 
that the ICE cable cannot be interchanged with other MICE-II models . ) 

2) Connecting the ICE Cable for MICE-II Z8 

The ICE cable assembly consists of two flat-wire cables with dual 40-pin 
connectors at one end (CHZB) and a single 40-pin connector at the other end 
(THZB) . To install the ICE cable after setup has been completed, remove. the 
MICE-II cover and attach the end with dual 40-pin connectors at position J5 
on the CEP board. Thread the IC header end through the rectangular opening 
in the MICE-II case and slide the cover shut (section 2.1.7). Then attach 
the end with a single 40-pin connector to the 40-pin target processor socket 
on the target board. (Note that the ICE cable cannot be interchanged with 
other MICE-II models.) 




THZa BOARD 



TARGET BOAUD 
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3) Connecting the ICE Cable for MICE-II ZS8 

Two different ICE cables are used for 40 and 48 pin target CPUs. The ICE 
cable assembly for a 40-pin target CPU consists of two flat-wire cables with 
dual 40-pin connectors at one end and a single 40-pin connector at the other 
end {THZS8-40). The ICE cable assembly for a 48-pin target CPU consists of 
two flat-wire cables with dual 50-pin connectors at one end and a single 48- 
pin connector at the other end {THZS8-48) . 



To install the ICE cable after setup has been completed, remove the MICE-II 
cover and attach the end with dual 40/50 pin connectors at position J6/J5 on 
the CEP board. Thread the IC header end through the rectangular opening in 
the MlCE-II case and slide the cover shut (section 2.1.6). Then attach the 
end with a single 40/48 pin connector to the 40/48 pin target processor 
socket on the target board. (Note that the ICE cable cannot be interchanged 
with other MICE-II models . ' 
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CRoraro 

USE 



SOCETT PRCTECTCf? 
4S PIN 

TAHGET PROCESSOR 
SOCKET 4SPIN 



TARGET BOARD 



2.1.6 Connecting the External Trace Cable 

The external trace cable shown below is used for recording external signals 
during trace operations. To monitor any external activity not automatically 
recorded by trace commands, the input cable must be connected from the trace 
point connector on the CEP board to the target. This connector consists of a 
9 post stick header on the CEP board designated X0-X7 from right to left, 
plus XG for ground. 

The monitored signals are called spare bits and support concurrent trace 
with the address, data and status bus. Any of these bits can be monitored by 
trace commands to display hardware status {in the SPARE column) by executing 
List, Cycle Step and Instruction Step commands; where "1" represents a high 
(or floating) signal and "0" indicates a low signal. 




9 black (for GNO) 



9-pin 0-type 
connection, male 



1-8 red (for signal connection) 



Figure 2-3 
Signal Monitor Cable 

2.1.7 Closing the MICE-II Case 

To close the cover, set it over the base leaving a 1/2 inch gap. Holding 
the base firmly in the front, use your thumbs to push the cover the remain- 
ing distance. This will force the locking tabs into position and firmly 
attach the top to the base. 
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2.2 MICE-II Specifications 

Mechanical specifications for MICE-II are: 



Width 


20.0 cm 


{ 7.87 in) 


Height 


8.0 cm 


( 3.15 in) 


Length 


33.0 cm 


{13.00 in) 


Weight 


2.0 kg 


( h.kO lb) 



The minimum and maximum operation and storage limits for temperature and 

humidity are: 

Operating temperature: 0O~50OC (32°~122°F) 
Storage Temperature: -10O~65OC {I'tO-l^gOp) 
Relative Humidity: 20 ~80^ 

MICE-II requires three external power supply voltages, each of which must be 
regulated to within 5 percent of nominal. 

Power Consumption Ripple 

+ 5VDC at 4.0A (maximum) 50m Vp-p 

+12VDC at O.IA (maximum) 100m Vp-p 

-12VDC at O.IA (maximum) 100m Vp-p 

Note: Power supply loading is based on conventional MICE-II modules. Since 
MICE-II supports emulation memory expansion, additional power supply 
requirements may be necessary depending on the number of memory boards 
added and/or cooling fan is installed. Each additional memory board 
requires 0.8 amp at +5 VDC and each cooling fan requires 0.35 amp at 
+12 VDC. The switching power supply should also be grounded. 

Using the supplied power cable, the mating female connector is attached to 
the pins at the rear of MICE-II with the locking tab pointing up. The power 
connector pinout is as follows: 

Pin 



1 
2 
3 

5 



1 
2 
3 

5 



Description 



+5VDC 

Ground 

+12VDC 

not connected 

-12VDC 



Warning: Be sure that the correct voltages are connected to the proper pins, 
otherwise MICE-II may suffer severe damage to its circuitry. When 
turning off the power to MICE-II, wait a few seconds to allow the 
capacitors to fully discharge before turning the power on again. 
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2.3 Communicating with MICE- II 

Whether MICE-II is connected to a terminal or to a computer system, the 
connection between the controlling device and MICE-II is across a programma- 
ble RS-232C compatible interface. 

2.4 Control Emulation Processor Board (CEP) Setup 

Other MICE-II emulators can be formed simply by replacing the personality 
(CEP) board. If a change of personality boards is required, or modification 
to the factory preset conditions is necessary, the adjustment options are 
described in the following sections. 

2.4.1 Interface Parameter Selection 

On the CEP board locate the six position DIP switch (NSCSOO - U35 and all 
others - U17) . This switch sets the following communication modes which are 
only examined by the control processor during power-up and reset. 



Switch Selection 


Description 


S1-S2-S3 


Baud Rate 


S4 


7/8 Data Bits 


S5 


Disable/Enable Parity 


S6 


Odd/Even Parity 



The number of stop bits is permanently set at two; and communication is full 
duplex. Each data frame consists of 1 start bit, 2 stop bits, 7/8 data bits 
and 1 parity bit if parity is enabled. 

The transmission rate can be specified from 150-19200 baud by setting S1-S2- 
S3 of the DIP switch as follows: 



Baud 


Switch Section 


Rate 


Si 


S2 


S3 


150 


ON 


OFF 


OFF 


300 


OFF 


ON 


OFF 


600 


ON 


ON 


OFF 


1200 


OFF 


OFF 


ON 


2400 


ON 


OFF 


ON 


4800 


OFF 


ON 


ON 


9600 


ON 


ON 


ON 


19200 


OFF 


OFF 


OFF * 



* This setting is only effective for the following (or later) firmware ver- 
sions: V3.0 - ZS8, V3.1 - Z8O/Z8 and V3.2 - NSC8OO. For all previous ver- 



o 1 rv-no 



l-hn o C3U7T i-nh ooM-t ncp n nHi f^ahfici 110 haijd * 
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The number of data bits and parity can be specified by setting S4, S5 and S6 
of the DIP switch as follows: 





Switch Sec 


tion 


Mode 


S4 


S5 


S6 


8 Data Bits 


OFF 






7 Data Bits 


ON 






Parity Enable 




OFF 




Parity Disable 




ON 




Even Parity 






OFF 


Odd Parity 






ON 



MICE-II personality boards are shipped from the factory preset to 2400 baud, 
7 data bits, and parity enabled at even. Switch position for this default 
selection is as follows: 



Mode 



Switch Position 





SI 

ON 

1 
1 


S2 

OFF 

1 
1 


S3 

ON 

1 
1 


ON 


S5 

OFF 

1 
1 
1 

1 


S6 

OFF 


2400 Baud 




1 
1 






7 Data Bits 








Parity Enable 












Even Parity 















Default setting 

When parity is disabled, the odd/ even parity switch section can be set to 
either position since it is ignored. 

2.4.2 Clock Selection 

1) Clock Selection for MICE-II Z80 

MICE-II ZBO supports the ZBO dynamic RAM refresh function and is available 
in the following versions: 

Z80 - 2.5MHz clock oscillator 
Z80A - 4mHz clock oscillator 
Z80B - 6MHz clock oscillator 
Z80H - 8MHz clock oscillator 



The target's clock, the on-board clock, or the on-board clock with an option 
to support the target can be selected by placing jumpers on the personality 
board as follows: 

X8 X9 XIO Xll 



EXT 


C 








c 


INT 





c 


c 





INT — > 

TARGET 


C 





c 






C: Close 
0: Open 

Internal/External Clock Selection 

2} Clock Selection for MICE-II NSC800 

The target's clock or the on-board 5 MHz clock can be selected by placing 
jumpers on the personalitj- board as follows: 





X8 


X9 


XIO 


Xll 




INT 








c 


c 


C: Close 


EXT 


C 


c 








0: Open 



Intemal/ExtemEil Clock Selection 

3) Clock Selection for MICE-II Z8 

The target's clock or the on-board 12MHz clock can be selected by placing 
jumpers on the personality board as follows: 

THZ8* 
Adapter 





X8 


X9 


XI 


X2 


X3 


1 INT 


C 











1 


i EXT 
|TTL CLOCK 





C 





C 


1 


j EXT 
1 CRYSTAL 





C 


C 





c 1 



C: Close 
0: Open 
Internal/External Clock Selection 

*The THZ8 Adapter is located on the target side of the ICE cable. 
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4} Clock Selection for MICE-II ZS8 

The target's clock or the on-board 20MHz clock can be selected by placing 
jumpers on the personality board as follows: 

THZS8* 
Adapter 





X8 


X9 


XI 


X2 


X3 


INT 


c 














EXT 
Ti'L CLOCK 







c 









c 





EXT 
CRYSTAL 







c 




c 







c 



C: Close 
0: Open 

Internal/External Clock Selection 

*The THZS8 Adapter is located on the target side of the ICE cable. 

2,4.3 Ready Signal Selection (Z80 and NSC800} 

1) Ready Signal Selection for MICE-II Z80 

The target ready signal, or on-board ready signal (when memory is located in 
UEM/HUEM) can be selected by placing jumpers on the personality board as 
follows : 

Xlk X15 



TARGET 
ON-BOARD 




C 



C 




C: Close 
0: Open 



2) Ready Signal Selection for MICE-II NSCSOO 

The target ready signal can be selected by removing the jumper at Xl4; or if 
MICE emulation memory is selected, the on-board ready signal can be used by 
connecting a jumper at Xl4. 

2.4.4 Bus State Selection (ZSO) 



MICE-II Z8 per mits the CPU to be stopped at eithe r WAIT or BUSAK state. 
Stopped at WAIT state, the two refresh signals RFSH, MREQ will be lost but 
the CPU will stop in the middle of the machine cycle. Therefore, the mes- 
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sages displayed have not yet been executed. Under this condition, the DATA 
BUS, ADDRESS BUS and STATUS signals are stil l active and can be read. This 
simplifies hardware debug. Stopped at BUSAK state, refresh is still sup- 
ported to the target; and the CPU will stop at the end of the machine cycle 
where the messages displayed have already been executed. Selection is shown 
below: 





X12 


X13 




C 




WAIT 












BUSAK 


C 



C: Close 



0: Open 



WAIT/BUSAK Mode Selection 

^.-To Vcc Selection (NSC800) 

The NSCSOO Vcc on the target can be selected by removing the jumper at X12; 
or the on-board Vcc can be used by placing a jumper at XI3. 





X12 


XI3 




INT 





C 


C: Close 


EXT 


C 





0: Open 



Internal/External Vcc Selection 

2.5 Universal Emulation Memory Board (UEM) Setup 

There are three DIP switches located in front of the UEM board (bottom 
board of MICE-II module). These are U35, U36 and U37 from right to left, 
with individual switches designated SI through S6 or S8. 

The DIP switches are set up per the following instructions: 

2.5.1 U35: Emulation Memory Block - Enable/Disable 

Any 4K byte memory block can be disabled or enabled depending on the amount 
of emulation memory needed. Set individual switch positions ON for enable 
and OFF for disable. 

SI S2 S3 S4 S5 S6 S7 S8 
Lowest 'tK Highest 4K 
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2.5.2 U36: Offset Address Setting and Memory Protect/Enable 

The starting address of 32K bytes of emulation memory can be set as follows: 



Starting 










Address 


SI 


S2 


S3 


SH 


OOOOH 


OFF 


OFF 


OFF 


OFF 


lOOOH 


ON 


OFF 


OFF 


OFF 


2000H 


OFF 


ON 


OFF 


OFF 


3000H 


ON 


ON 


OFF 


OFF 


4000H 


OFF 


OFF 


ON 


OFF 


5000H 


ON 


OFF 


ON 


OFF 


6000H 


OFF 


ON 


ON 


OFF 


7000H 


ON 


ON 


ON 


OFF 


8000H 


OFF 


OFF 


OFF 


ON 


9000H 


ON 


OFF 


OFF 


ON 


AOOOH 


OFF 


ON 


OFF 


ON 


BOOOH 


ON 


ON 


OFF 


ON 


COOOH 


OFF 


OFF 


ON 


ON 


DOOOH 


ON 


OFF 


ON 


ON 


EOOOH 


OFF 


ON 


ON 


ON 


FOOOH 


ON 


ON 


ON 


ON 



Note: The offset address is relative to the memory segment. The ending 
address for UEM is the offset address plus 32K bytes. When the ending 
address crosses the 64k boundary, it wraps around and starts at OOOOH. 



Positions 85 and S6 are set as follows: 



Mode 



Write Enable 


ON 




Write Protect 


OFF 




Memory Enable 




OFF 


Memory Disable 




ON 



85 86 
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2.5-3 U37: Memory Segment Select 

Memory segments may be selected within 16m bytes by setting U37 as follows: 



Segment 


Start 


Address 


SI 


S2 


S3 


S4 


S5 


S6 


S7 


88 


OK 




OH 


ON 


ON 


ON 


ON 


ON 


ON 


ON 


ON 


64k 




lOOQOH 


OFF 


ON 


ON 


ON 


ON 


ON 


ON 


ON 


128k 

It 




20000H 

11 


ON 


OFF 


ON 


ON 

tf 


ON 


ON 


ON 


ON 


16320K 




FFOOOOH 






It 

All OFF 









2.5.4 Sample Setting for UEM Board 

U35 SI S2 S3 S4 S5 S6 S? S8 

ON ON OFF OFF OFF OFF ON ON 

U36 31 S2 S3 Sk 85 S6 

OFF OFF OFF ON OFF OFF 

U37 81 82 S3 Sk 85 S6 87 S8 

ON ON ON ON ON ON ON ON 

In the above configuration. Memory Segment {U37) is set at OK with an Offset 
Address (U36) of 32K (8OOOH} ; therefore 32K of Emulation Memory (U35) is 
configured as follows: 

32K - 36K Write Protect 

36K - 40K Write Protect 

40K - kkK Disable 

kkK - 48K Disable 

48k - 52K Disable 

52K - 56K Disable 

56K - 6OK Write Protect 

6OK - 64K Write Protect 
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2.5.5 Factory Preset 

The UEM board is factory preset with the following switch positions: 

U35 SI S2 S3 Sl\ S5 S6 S7 S8 

ON ON ON ON ON ON ON ON 

With all keys of U35 in the ON position, all blocks of emulation memory are 
enabled . 

U36 SI S2 S3 Sk S5 S6 

OFF OFF OFF OFF ON OFF 

In this configuration the starting address is OOOOH, emulation memory is 
enabled and write-enabled. 

U37 Si S2 S3 Sh 85 S6 S7 S8 

ON ON ON ON ON ON ON ON 

All U37 keys are in the ON position. In this configuration the memory 
segment start address is OOOOH. 

Setting U35, U36 & U37 completes setup of the UEM board. 

2.6 High Performance Universal Emulation Memory Board (HUEM) Setup 

There are four DIP switches located at aie front of the HUEM board {bottom 
board in the MICE-II module); Ul'l/U28 (enabled for both the standard e'lK 
byte version and the optional 128K byte version) and U36/U43 (enabled only 
for the optional 128K byte version) . The individual keys on the switches are 
designated SI through S8 or SIO. (Refer to the placement chart on page F-h 
for the board location of these switches . ) 

There are two separate 64k memory banks in the HUEM. (Offset adaress listed 
for UEM is not available for HUEM.) Ul4 and U28 set bank 1; and U36 and U43 
set bank 2. (Note that bank 2 is only populated for the optional 128K byte 
version. ) 
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The DIP switches set up are explained in the following paragraphs. 

2.6.1 Ul^ and U36: Emulation Memory Enable/Disable 

The user can select any memory block of 8K bytes to disable or enable 
depending on the amount of emulation memory needed. Set individual keys ON 
for enable and OFF for disable. 

SI S2 S3 S4 S5 S6 S7 S8 
Lowest 8K Highest 8K 



Position S9 and SIO are used as follows: 

Mode 



Write Enable | ON 
Write Protect | OFF 
Memory Enable 
Memory Disable 

2.6.2 iJ28 and Uh3: Memory Segment Select 



S9 SIO 



OFF 
ON 



Memory segments may be selected within I6M bytes by setting U28 and U43 as 
follows : 



Segment 


Start 


Address 


SI S2 


S3 S4 S5 


S6 


S7 


S8 


OK 




OH 


ON ON 


ON ON ON 


ON 


ON 


ON 


6i}K 




lOOOOH 


OFF ON 


ON ON ON 


ON 


ON 


ON 


128k 




20000H 

tt 


ON OFF 


ON ON ON 

t! 


ON 


ON 


ON 


ft 

I632OK 




FFOOOOH 




tt 

All OFF 









Note: If bank 1 and bank 2 have the same start address (i.e. U28 and U43 
have the same key setting) , HUEM will select bank 1 only and disregard 
the U43 key setting for bank 2. For 64K HUEM, only bank 1 memory is 
populated . 
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2.6.3 Factory Preset 

HUEM is preset at the factory with the following switch positions (0-128K 
bytes ) : 

U14.U36 SI S2 S3 S4 S5 S6 S7 S8 S9 SIO 

ON ON ON ON ON ON ON ON ON OFF 

In this configuration all blocks (64k byte x 2} of emulation memory are 
enabled and write enabled. 

U28 SI S2 S3 S't S5 S6 S7 SB 

ON ON ON ON ON ON ON ON 

All U28 keys are in the ON position. In this configuration, the bank 1 
memory segment start address is OOOOH. 

U43 SI S2 S3 S4 S5 S6 S? S8 

OFF ON ON ON ON ON ON ON 

Only SI is OFF. In this configuration, the bank 2 memory segment start ad- 
dress is lOOOOH. 

Setting Ul4, U28, U36 and U43 completes setup of the HUEM board. 
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2.7 Memory Selection for Microcontrollers (Z8 and ZS8) 
2.7.1 Memory Selection for MICE-II Z8 



x; iiit; z-o ictui_Lxy ui 



jr-ocessors has three types of memory: internal program 
memory (P) , external program memory (P) , and external data memory (X). P 
and X serve as optional qualifiers for M/T commands, with program memory 
(P) as the default value. Note that if qualifier X is used to address 
internal program memory, an error message will display: "LOCATION ERROR!" 



CPU 


Addressable Memory 


Addressable I/O 




Internal Program 


External Program 


External Data 


Z8611/Z8613 


OOOH-FFFH 


lOOOH-FFFFH 


lOOOH-FFFFH 


Ports P0-P3 


Z8601/Z8603/Z8671 


000H-7FFH 


8OOH-FFFFH 


8OOH-FFFFH 


Ports P0-P3 


Z8681 


none 


OOOH-FFFFH 


OOOH-FFFFH 


Ports P0-P3 


Z8682* 


none 


800H-FFFFH 


8OOH-FFFFH 


Ports P0-P3 



*00GH-7FFH is not addressable. 

2) Internal program memory (4K bytes) is located in emulation memory on the 
CEP board (6264 RAM at U5I) . 

3) If program memory is larger than 4K bytes or external data memory is 
used, then a UEM/HUEM board must be used for emulation memory. To select 
UEM/HUEM, set control register POIM (FBH) with the R command, or with the 
user's program, to define Port in address mode {PO=ADDR) and Port 1 in 
address/data mode (P1=A/D} ; i.e. set D7; D4 &. Dl=l and D3=0 in register 
POIM (RF8=1XX10X1X) . 

Example: Set RF8=96H to specify - 

a) P00-P07=A8-A15 
b} P10-P17=AD0-AD7 

c) internal stack pointer 

d) normal external memory timing 

k) However, if memory space is segregated, then input the EX command (Chap- 
ter 6) , and logically select program memory and data memory using Data 
Memory select output. Define Port3-pin4 for Data Memory output, by set- 
ting control register P3M (F7H) with the R command, or with the user's 
program, to P34=DM. External segregated emulation memory is located in 
UEM/HUEM, with program memory at lOOOH-FFFFH and data memory at llOOOH- 
IFFFFH. 



Example: If the program memory range is 0~3FFFH and data memory range is 

lOOOH-lFFFH, then set emulation memory as indicated below for 
UEM or HUEM. 

UEM Set these two parameters regardless of the option selected - 

* emulation memory block enable/disable (U35 SI -8 all ON) 

* memory offset address to OH (U36 S5 ON, all others OFF) 

a) Emulate program memory only by setting - 

* memory segment to OH {U37 SI -8 all ON) 

* starting address to OH (U36 S5 ON, all others OFF) 

b) Or emulate data memory only by setting - 

* memory segment to lOOOOH (U37 SI ON, all others OFF) 

HUEM Enable all emulation memory by setting - 

* Ul4 and U36 S1-S9 ON and 810 OFF 

Emulate program memory in bank 1 by setting - 

* memory segment to OH (U28 Sl-8 all ON) 
Emulate data memory in bank 2 by setting - 

* memory segment to lOOOOH {U43 31 OFF, all others ON) 

5) HUEM can cover the entire emulation memory range required for external 
program and external data memory (max 120K bytes) , butt UEM can only cover 
part of this range (max 32K bytes). 

Because the first 4k bytes of program memory are located on the CEP board 
at U5I, do not set the offset address {U36) within the first 4k bytes of 
UEM. However, because the offset address cannot be defined for HUEM, the 
first 4K bytes of both memory banks are disabled. (For information on 
UEM/HUEM switch settings refer to section 2.5 and 2.6. 



Emulation Memory Sel ection 



Required Memory 

Size 
Emulation 
Memory Location 



<4k bytes 



>tiK bytes 



Segregated 

(set EX. & P34=DM) 



Combined 

(set DX) 



UEM 



Not needed 



Use for program 
or data memory 
(max 32K bytes) 



Max 32K bytes 



HUEM 



Not needed 



Use for program 
or data memory, 
or both 
(max 120K bytes) 



Max 60K bytes 



CEP U51(6264)^ 



Used as internal program memory (Max Hk bytes) 



*If program memory (0-4K) is located in target ROM, either read the data 
into the host computer and then download it to MICE emulation memory, or 
place the target ROM (if a 2732 or 2764) on the CEP-Z8 at U5I. 
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a) If HUEM is selected and memory is combined, then both program and data 
memory must be located in the same memory bank (HUEM has two separate 
64k byte memory banks) with the memory segment set to OH (U37/U43 Sl-8 
all ON). Because the first hK bytes (in each memory bank) are always 
disai^led \0K-4K internal program memory is located on the CEP-ZS) , the 
meiximum addressable memory on HUEM is 60K bytes. 

However, if memory is segregated, then program memory should be locat- 
ed in one memory bank and data memory in the other bank. The maximum 
addressable memory on HUEM is then 120K bytes. 

b) When using UEM, up to 32K bytes of external memory can be defined. The 
start address for 32K bytes of emulation memory can be specified any- 
where within the available emulation memory (section 2.5.2). 

c) The first 'IK bytes are always internal program memory. Remember that 
the 2K to 4k bytes of external program memory down-loaded to the CEP-Z8 
for the Z8601, Z86O3, Z876I and Z8682 is addressed as internal memory. 

2.7.2 Memory Selection for MICE- II ZS8 

1) The Super-8 family of processors has three types of memory: internal pro- 
gram memory (P) , external program memory (P) , and external data memory 
(X). P and X serve as optional qualifiers for M/T commands, with program 
memory (P) as thedef aultvalue . 



rpii 1 Addressable Memory 


Addressable I/O 


1 Internal Program | External Program 


External Data 


Z88II/Z88I3 1 OOOOH-OFFFH | lOOOH-FFFFH 


OOOOH-FFFFH 


Ports P0-P3 


Z882I/Z8823 1 OOOOH-IFFFH | 2000H-FFFFH 


OOOOH-FFFFH 


Ports P0-P3 


Z883I/Z8833 1 0000H-3FFFH | 4000H-FFFFH 


OOOOH-FFFFH 


Ports P0-P3 


Z88IO/Z8812 1 OOOOH-OFFFH | lOOOH-FFFFH 


OOOOH-FFFFH 


Ports P0-p4 


Z882O/Z8822 i OOOOH-IFFFH : 2000H-FFFFH 


OOOOH-FFFFH 


Ports P0-P4 


Z883O/Z8832 ; 0000H-3FFFH | 4000H-FFFFH 


OOOOH-FFFFH 


Ports P0-P4 


Z88OI 1 none | OOOOH-FFFFH 


OOOOH-FFFFH 


Ports P2-P3(P0) 


Z88OO 1 none | OOOOH-FFFFH 


OOOOH-FFFFH 


Ports P2-P4(P0) 



The Z88OO and Z88OI microprocessors can use port PO for addressable I/O 
or external memory, where the address range is selectable at OOOOH-OFFFH 
or OOOOH-FFFFH depending on address pin definition. 
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2) Internal program memory (0/4/8/16 Kbytes) is located in emulation memory 
on the CEP board (two 6264 RAMs at U52 and U53) . The size of the internal 
memory to be emulated is selected by placing jumpers on the personality 
board as follows. 



1 Internal Memory 


Jumper Setting ] 


1 Size 


XIO 1 Xll i X12 1 X13 1 


1 none (ROMless) 


C 1 1 C 1 I 


1 4K 


1 C 1 1 c 1 


1 8K 


C 1 1 i C 1 


j 16K 


1 C 1 C 1 1 



C: Close 
0: Open 



Size of Internal Program Memory 



3) If the user's program is larger than internal program memory or external 
data memory is used, then a UEM/HUEM board must be used for emulation 
memory. To select UEM/HUEM, set mode register POM (FOR, BANKO) and PM 
(FIH, BANKO) with the R command, or with the user's program, to define 
PortO inaddressmode (PO=ADDR) and Port 1 inaddress/datamode (P1=A/D) ; 
i.e. set D7-D0=l in register POM (RSOFO=FF) , and D5=l in register PM 
{RS0F1=20) . 

Example: Set RSOFO=FF and RS0F1=20 to specify - 

a) P00-P07=A8-A15 

b) P10-P17=ADO-AD7 

4) However, if memory space is segregated, then input the EX command (Chap- 
ter 6) , and logically select program memory and data memory using Data 
Memory select output. Define Port3-pin5 for Data Memory output, by set- 
ting mode register PM (FIH, BANKO) with the R command, or with the user's 
program, to P35=DM. External segregated emulation memory is located in 
UEM/HUEM, with program memory at OOOOH-FFFFH and data memory at llOOOH- 
IFFFFH. 

Example: If the external program memory range is 4000H~BFFFH and data 
memory range is 1000H~8FFFH, then set emulation memory as indi- 
cated below for UEM or HUEM. 

UEM a) Emulate program memory only by setting - 

* memory segment to OH (U37 Sl-8 all ON) 

* starting address to 4000H (U36 S3/S5 ON, all others OFF) 

b) Or emulate data memory only by setting - 

* memory segment to lOOOOH (U37 SI OFF, all others ON) 
♦starting address to lOOOH (U36 S1/S5 ON, allothers OFF) 
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HUEM Enable all emulation memory by setting - 

* Ul4 and U36 S1-S9 ON and SIO OFF 

Emulate program memory in bank 1 by setting - 

* memory segment to OH {U28S1-8 all ON) 
Emulate datamemory in bank 2 by setting - 

* memory segment to lOOOOH (U43 SI OFF, all others ON) 

5) HUEM can cover the entire emulation memory range required for external 
program and external data memory (max 128K bytes), but UEM can only cover 
part of this range (max 32K bytes). 

Because Internal program memory is located on the CEP board at U52/U53, 
do not set the offset address (U36) for UEM within the internal memory 
range. However, the offset address cannot be defined for HUEM. Therefore, 
the first 0/4/8/16 Kbytes of the memory bank containing program memory 
are disabled when emulation memory is segregated, and the first 0/4/8/16 
Kbytes of both memory banks are disabled when emulation memory is com- 
bined. (For information on UEM/HUEM switch settings refer to section 2.5 
and 2.6. 

^QuXatxon Memory Sej-ectxon 



1 Required Memory | I >0/4/8/l6 Kbytes* 
1 Size 1 0.<4/8/l6 Kbytes* | (Microcomputer) 


1 Emulation | (Microcontroller) | Segregated | Combined 
! Memory Location | | (set EX, & P35=DM) | (set DX) 


i UEM i Not required | Use for program | Max 32K bytes 
1 1 1 or data memory | 
1 i i (max 32K bytes) | 


1 HUEM j Not required | Use for program | Max 64K bytes 
1 1 1 or data memory, | 
] 1 1 or both 1 
1 1 1 (max 128k bytes) ', 


|CEP U52/53( 6264x2)**! Used as internal program memory (Max I6K bytes) 



* Depends on the target processor under emulation. 
** If internal program memory is located in target ROM, either read the da- 
ta into the host computer and then download it to MICE emulation memory, 
or place the target ROM (if a 2764) on the CEP-ZS8 at U52 or U53. 

a) If HUEM is selected and memory is combined, then both program and data 
memory must be located in the same memory bank (HUEM has two separate 
64k byte memory banks) with the memory segment set to OH (U37/u43 Sl-8 
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16 Kbytes internal program memory is located on the CEP-ZS8) , the max- 
imum addressable memory on HUEM is 64 Kbytes. 

However, if memory is segregated, then program memory should be locat- 
ed in one memory bank and data memory in the other bank. The maximum 
addressable memory on HUEM is then 128K bytes. 

b) When using UEM, up to 32K bytes of external memory can be defined. The 
start address for 32K bytes of emulation memory can be specified any- 
where within the available emulation memory (section 2.5.2). 

2.8 RS-232C Cable Connection 

After selecting the proper data rate and transmission characteristics , next 
determine whether the controlling device has a data terminal equipment (DTE) 
interface or a data communication equipment (DOE) interface, with or without 
handshaking. Display terminals are usually equipped with DTE interface; 
computer systems usually have both. 

There are several methods for determining the type of interface on the con- 
trolling device. The first method is by simple trial and error. If this 
fails, procedures two and three listed below can be used to determine the 
interface type. (It must be known beforehand whether or not handshaking is 
selected as a software option for the controlling device, as it cannot 
be easily detected by examining hardware signals.) Subsequent instructions 
detail how to accomplish interface header rewiring if required. 

1) Try connecting the two devices together. If the response is correct, the 
interfaces match and no further adjustment is required. If the intercon- 
nect does not work, a mismatch exists and indicates that a connection 
change is necessary. 

2) Data are transmitted on pin 2 and received on pin 3 of the D-connector 
for DTE devices; the reverse is true for DOE devices. 

3) When not transmitting, the voltage (with respect to pin 7 [ground] of the 
D-connector) is -12 VDC on pin 2 for DTE devices and -12 VDC on pin 3 for 
DCE devices. 

The header designated as U13 on the CEP board is used to configure the 
interface between MICE-II and the controlling device. MICE-II are shipped 
from the factory with a straight-wired header for DTE with handshaking. 
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Pins 1-7 on the interface header are connected to the female D-connector 
(J2) while pins 8-l4 are connected to the MICE-II, RS-232C interface logic. 
Pin definitions on the header are shown below: 



RS-232C Signals 



D-connector 



nectutji- 



MICE Logic Side 



pin 20 2 



(female] 

CF-Data Carrier Detector pin 8. 
CD-Data Terminal Ready 
CC-Data Set Ready 
CB-Clear To Send 
CA-Request To Send 
BB-Received Data 
BA-Transmitted Data 



pin 
pin 
pin 
pin 
pin 



6. 

5. 

3. 
2. 



14- 

13- 
12- 
11- 
10- 
9- 



-^ +12 VDC 

* Oo*-DSR of 825IA 

-•— (xa — DTR of 825IA 

o<3— RTS of 825IA 

-CTS of 825IA 
-(XI — TxD of 825 lA 
-CXJ— RxD of 825IA 



*RS-232C interface gate for l488 or 1489 depending on signal Input or Output. 

The wiring configuration for all three header types is shown below. Note 
that if the controlling device has a DCE interface, incoming signals are now 
outgoing, and vice versa, on the same pins. By removing the cover to the 
header, the interface type used by MICE can be determined according the 



following wiiiii^ cono. igdration. 

DTE with DCE with DTE without DCE without 
handshaking handshaking handshaking handshaking 



1 — 

2 — 

3 - 

4 — 

5 - 

6 - 

7 - 



14 

13 
12 
11 
10 
9 



X 
X 



14 

13 
12 
11 
10 
9 



14 

13 
12 
11 
10 
9 



X 



14 

13 
12 
11 
10 
9 



{from MICE) 
(to MICE) 
(from MICE) 
(from MICE) 
(to MICE) 
(from MICE) 
(to MICE) 



Data Carrier Detector 
Data Terminal Ready 
Data Set Ready 
Clear to Send 
Request to Send 
Received Data 
Transmitted Data 



When wired for DTE, connect MICE-II using a straight-wire cable with male D- 
connectors; for other header types, the cable must be rewired accordingly. 
If a display terminal is connected after making the proper connections, 
MICE-II should respond when power is applied. (A display terminal should 
always be used to check new MICE-II units to ensure that they are properly 
functioning. ) 

Finally, MICE-II requires that both Request to Send and Data Terminal Ready 
inputs, pins 10 and 13 respectively on the logic side of the header, be at 
+12 VDC before it transmits any data. If the controlling device does not 
supply the necessary voltage, it can be obtained by reconnecting pins 10 and 
13 directly to pin l4 (Received Line Signal Detector) of header U13 which is 
always at +12 VDC. 
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To accommodate computer systems which are sending commands and data too idst 
for MICE-II, the Data Set Ready output, normally at +12 VDC, is pulled low 
by MICE-II to -12 VDC. The signal is restored to +12 VDC when MICE-II is 
again ready. Also, to accommodate display terminals with slow carriage- 
returns or line-feeds, six null characters are always transmitted after a 
carriage- re turn is issued. 



2.9 Applying Power to MICE-II 

Connect the RS-232C cable from the controlling device to the female D- 
connector at the rear of MICE-II. (The recommened power-on sequence is to 
first apply power to the target and then to MICE-II; and to use the opposite 
sequence when poweringoff . ) With the controlling device ready, connect the 
power cable with the locking tab pointing up, and apply power. Within a few 
seconds, the following start-up message should display: 

***MICE-II-type V#.#»** 
> 

type identifies target processor being emulated by the personality card. 

#.# indicates version number of controlling program on personality card. 

> is the prompt character indicating that MICE-II is ready for a command. 

In response to the command prompt character ">" enter a question mark "?", 
immediately followed by a carriage-return. If the data bits and parity are 
correctly matched, the MICE-II command summary is listed; otherwise, the 
error message "WHAT?" is printed. Reset the switch section where necessary 
and remember to wait a few seconds before power is turned on again. 

Notes 1) If target VCC is not provided when MICE-II is powered up, the fol- 
lowing message will display: 

Z80 - NO TARGET VCC; NMI, INTR, RESET, BUSRQ DISABLED! 

NSC800 - NO TARGET VCC; NMI, INTR, BREQ DISABLED! 

Z8 - NO TARGET VCC; IRQ, RESET DISABLED, MEMORY COMBINED! 

ZS8 - NO TARGET VCC; RESET DISABLED, MEMORY COMBINED! 

2) The CPU is automatically reset after power-up, software reset com- 
mand "r" (section 2.10) or MICE Reset command X (section 5.7). If 
the target system has any peripheral devices or slave processors 
which must be synchronized with a CPU reset, then the reset must be 
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performed on the target side. A target reset signal will also reset 
the emulation CPU. However, the reset control signal for MICE must 
be enabled (section 6.2) for the Z80/Z8/ZS8, otherwise the target 
reset signal cannot reset the emulation CPU. 

Note that a synchronized reset may be performed by either MICE or 
the target system for the NSCBOO, since this processor supports a 
RESET output signal when the reset line for peripheral devices or 
slave processors on the target side is connected to reset pin-37' 

2.9.1 No Response 

If there is no response from MICE-Il, check the following items: 

1) Check the RS-232C cable connection at both ends. 

2) Check the power supply connections and voltages. 

3) Check that the header has the proper interface. 

T / WilcCK Uiiciu uwuii iici^^^y^ ^^ ocii^ cxLiu ua,\^<x j.t::i. mxilciu. iicak^y , pj.iiA xw cuiu j.3 

on the header are at +12 VDC. 

5) Check that the controlling device has the proper voltage level require- 
ments on its RS-232C inputs for transmission and reception. 

6) Check that the baud rates of the controlling device and MICE-II are the 
same, resetting if necessary. If a message does appear but is garbled, 
any combination of the baud rate, data length or parity could be incor- 
rectly set. 

7) Check the RS-232C cable for incorrectly wired or loose pins. 

8) If a computer system is the controlling device, check that the driver 
program is running and the RS-232C cable is connected to the correct port 
and that the port is working. 

Note: When changing the communication configuration switch, note that it is 
only read during a power-up or reset. After turning the power off, 
wait a few seconds before the power is turned on again to allow the 
capacitors to fully discharge. 

If the problem still cannot be found, contact your local Microtek represent- 
ative for further assistance. 
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2.9.2 Failure Device 

During the delay prior to the start-up message the RAMs and EPROMs on the 
CEP board are tested. If any component failures exist, they are listed as 
detected in the following format: "U## - FAILURE", where ## is the component 
number on the personality board. 

2.10 Control Processor Software Reset Command 

The character "r" is the command to reset MICE-II. Remember that except for 
this command all alphabetic characters must be entered in upper-case; no 
other lower-case characters are recognized. 
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CHAPTER 3 
MICE-II COMMAND LANGUAGE 



All MICE-II products have a common set of commands identified by a single 
or double character regardless of the processor being emulated. No addition- 
al time or effort is required to learn a new command language when the 
target processor changes. 

These commands are described in the following chapters along with a variety 
of available options, though not all options are applicable for the differ- 
ent types of processors. For the specific processor being emulated, consult 
the Help "?" command. The commands described in the following chapters are 
grouped as follows: 

MICE-II Utility Commands 

? Help Command 

! Attention Command 



M Memory Display/Examine/Modify/Fill/Search Command 

T Memory Checksum/Test/Transfer/Compare Command 

A Line Assembly Command 

Z Disassembly Command 

I Port Input Command 

Port Output Command 

R Register Display/Modify Command 

J Jump/Branch Command 

X Reset/Initialization Command 

Control Signal Commands 

D Disable/Display Control Signal Command 
E Enable/Display Control Signal Command 

Emulation and Trace Control Commands 

G Go/Execution Command 

H Halt/Breakpoint Set Command 

F Forward Trace Command 

B Backward Trace Command 

L List Trace Buffer Command 

Stepped Emulation Commands 

C Single Cycle, Step Command 
S Instruction Step Command 

Utility Commands Involving a System 

3-1 



utility Commands Involving a System 

: Download Command (Intel Format) 

/ Download Command (Tektronix Format) 

U Upload Command 



3.1 Command Syntax 



MICE-II indicates that it is ready to accept a command line by printing a 
greater- than character ">" on a new line. A command may then be entered and 
must be terminated by a carriage- return <CR> . The general syntax of MICE-II 
commands is: 

command [parameters] <CR> 

where: command is the command representation. 

parameters are one or more variable data supplied with the command. 
Parameters are alphanumeric; when a numeric parameter is 
called for, it must be entered in hexadecimal. 

Where a space is shown in the syntax, either a space or comma can be used. A 
<CR> must be used to terminate a command input line. In most cases line feed 
<LF> or <CR> have the same effect, except where otherwise noted. Note that 
brackets [ ] and braces { } are used for describing command syntax only, and 
are not used in command input. 



3.2 Notations and Conventions 

A set of conventions is used to describe the structure of commands . The 
notations and rules are as follows: 

1) An upper-case entry must be input. 

2) A lower-case entry in the description of a command is the class-name for 
a parameter. A particular value for this class must be entered. A class- 
name never appears in an actual operable command. For example, the lower- 
case entry - "start-address" means that MICE-II will only accept a 
hexadecimal value as an address in the target processor's memory space. 

3) A required entry is shown without any enclosures; whereas an optional 
entry is denoted by enclosing it in brackets. For example, in the command 
description - "G[address]", the command "G" is required, and the brackets 
around the entry "address" means that it is optional in this command. 
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Where brackets are within another set of brackets, the entry enclosed by 
the inner brackets may only be entered if the items outside those inner 
brackets are first entered. For example, in the command description - 
"I port[ count[ time]]", the command "I" is required; and the brackets 
mean that the selection of "count" and "time" is optional in the command. 
However, a "count" must first be entered if a "time" value is to be 
specified. 

k) Where an entry must be selected from a choice of two or more, the choices 
for the required entry are enclosed in braces and separated by vertical 
bars. For example - "{SiM|a3[ V]}" indicates that either "S", "M" or "a3" 
must be entered. 

5) Where a choice exists for an optional entry, the choices are enclosed in 
brackets and separated by vertical bars. For example, "[N|I|B|R]" indi- 
cates that either "N" , "I", "B" or "R" may be entered. 

6) "Addx" is a hex address with a wildcard byte pair of "XX" or "XXXX", or 
a wildcard nibble of "X"; where X indicates that the digits are don't 
care. For example - "12XX" means all addresses between 1200H and 12FFH. 

7) Commands A/C/S/I/R all use carriage-return <CR> or line-feed <LF> to 
display the next line. 

8) In the Memory Modify (M) command, use a <CR> to advance to the next 
location and a <LF> to return to the previous location. 

9) Entries underlined in command examples indicate user input. 



3-3 Editing Characters 

Each character entered on the keyboard is stored in a line editing buffer 
until <CR> is entered. If more than 80 characters are entered without input- 
ting a <CR> , an error message is printed, Eind the command is ignored. 

The line editing buffer can be edited or entirely deleted by using special 
non-printable editing characters. Control characters are entered by holding 
down the control key <CTRL> while the character is typed. Control character 
input is expressed with the control command enclosed in < > brackets. 

BACKSPACE deletes the preceding character from the line buffer and from the 
display. Repeated usage is allowed. <CTRL-H> performs the same 
function. When a hardcopy terminal is used instead of a display 
screen, RUBOUT should be used. 
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RUBOUT deletes the preceding character from the line buffer and echoes 
the deleted character on the display, preceded by a backslash 
character. Repeated usage is allowed. On some terminals, this key 
may be labeled as DELETE or DEL. 

ESCAPE ignores the current contents of the line buffer and prompts ">" 
for a new command on the next line. This key is also used to 
terminate commands in process and to return to the prompt state. 
ESCAPE is also expressed as <ESC>. On some terminals, this key 
may be labeled ESC. <CTRL-Y> performs the same function. 

<CTRL-R> causes a <CR> or <LF> , followed by a redisplaying of the current 
undeleted contents in the line buffer. This is useful to see a 
clean copy of the command line after RUBOUT has been used, 

<CTRL-X> ignores the current contents of the line buffer and shifts the 
cursor to the first position of the next line, awaiting input of 
new data. 



3.4 Control Characters and Delimiters 

The following control characters have special meaning for all MICE-II firm- 
ware: 

<CTRL-J>: is the same as <LF>. 

<CTRL-M>: is the same as <CR>. 

<CTRL-S>: stops data transmission from MICE-II. 

<CTRL-Q>: continues data transmission from MICE-II. 

<CTRL-Y>: is the same as <ESC> . 
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3-5 Reference Program for Examples 

The following sample program for a Z80 target Is used as the basis for most 
of the examples listed in this user's guide. It includes commonly used in- 
structions for T^erf orminc** various bus cycles. 



LOG 


OBJ 


0000 


310020 


0003 


CDOOOl 


0006 


DD210O3O 


OOOA 


110010 


OOOD 


lA 


OOOE 


DD7700 


0011 


DD23 


0013 


13 


0014 


7B 


0015 


FEOF 


0017 


C20D00 


OOIA 


C30000 


0100 


110010 


0103 


3E20 


0105 


12 


0106 


7B 


0107 


13 


0108 


FEOF 


OlOA 


C20301 


OlOD 


C9 


OlOE 


3A003A 



LINE 


LABEL 


SOURCE CODE 


0001 


BOOOO 


LD 


SP,2000 


0002 




CALL 


0100 


0003 




LD 


IX, 3000 


0004 




LD 


DE.IOOO 


0005 


BOOOD 


LD 


A.(DE) 


0006 




LD 


(IX+00),A 


0007 




INC 


IX 


0008 




INC 


DE 


0009 




LD 


A,E 


0010 




CP 


OF 


0011 




JP 


NZ.OOOD 


0012 




JP 


0000 


0001 




LD 


DE.IOOO 


0002 


B0103 


LD 


A. 20 


0003 




LD 


{DE),A 


0004 




LD 


A.E 


0005 




INC 


DE 


0006 




CP 


OF 


0007 




JP 


NZ,0103 


0008 




RET 




0009 




LD 


A.{3A00) 



3-5 



CHAPTER 4 
MICE- II UTILITY COMMANDS 



These commands allow the user to query MICE-II for a summary of the commands 
and syntax that are available for the target under emulation. In addition, 
the user can query to display the processor type being used. 

Notes 1) If any code other than OFFH*^ is placed in firmware at the location 
indicated in table 4-1, it will cause the handshaking code at this 
location to be sent to the host computer {or terminal) when MICE is 
waiting for input. This extra code can be used to improve interface 
efficiency with the host. 

2) The handshaking code 003H*2 is sent to the host computer when MICE 
is waiting for input. Any code other than 003H may be placed in 
firmware (table 4-1) to suit the user's specific requirements. 

3) When using the MPDS software package MICEA8B, version V2.2 or ear- 
lier, the handshaking code used in MICE firmware (table 4-1) must 
be OFFH. For MPDS version 2.3 or later, there is no limitation on 
the handshaking code used in MICE. 



1 MICE-II 


CEP 
Location 


Address 


Handshaking Code 




OFFH*i 1 003H*2 (ETX) 


1 Z80 


U4 


IFFDH 


V1.0-V3.0 1 V3.1 & later 


1 NSC800 


U4 


IFFDH 


V1.0-V3.1 i V3.2 & later 


1 z8 


Ul 


3FFDH 


V3.0 1 V3.1 & later 


1 ZS8 


Ul 


3FFDH 


1 V3.0 & later 



Table 4-1 Handshaking Codes 
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h.l Help Command - ? 

7 



? is the command keyword for Help. 

The command summary for the target processor currently being emulated is 
displayed on the terminal. All commands are common regardless of target pro- 
cessor type, but command parameters may differ for the different processors 
under emulation. 

Example: Display the command summary for MICE-II Z80. 

>? 

ASSEMBLY A [loc] 

BACKWARD TRACE B [R] addx[ c[ q]] 

CYCLE STEP C [c] 

DISABLE D [N|I|B|R3 

INPUT I porti c[ time]] 

JUMP J address 

LIST TRACE L [step[ al[ a2[ q. . . ]]] lS[step] |Z[step] |N] 

MEMORY M [al[ a2[ dl...[ d8][ S]]]] 

OUTPUT port dl[ d2[...[ d8]]] 

REGISTER R [P][A|B |C|D|E|HjLi I 1F|X| YjS] 

INSTRUCTION STEP S [S|R][c]![Z] 

TRANSFER/TEST T al a2 S|M|a3[ V] 

UPLOAD U al a2[ T| I] 

RESET X 

DISASSEMBLY Z [al[ a2]] 

DOWNLOAD : (INT)./ (TEK) 

HELP ? [B] 

ATTENTION ! 

> 

The above summary does not fully follow the notations and conventions pre- 
viously described to avoid a lengthy display. 

MICE-II Z80 is used as the basis for all examples in this manual. Command 
syntax varies for different MICE-II emulators; for the proper syntax consult 
the Help (?) command. 
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k.2 Attention Command - ! 



! Is the command keyword for Attention. 

The target processor type currently being emulated by the personality card 
in MICE-II is displayed on the terminal. Six characters are used for identi- 
fication. 

Example: Display the processor type currently being emulated (Z80) . 

EPZ80R 
> 

The messages for 8-bit series processor types are: 

MICE-II TARGET PROCESSOR TYPE 



Z80 

NSCBOO 
Z8 
ZS8 



(Zilog Corporation) - EPZ80/EPZ80R 

(National Semiconductor) - EP8OO 

{Zilog Corporation) - CEP-Z8 

(Zilog Corporation) - EP-ZS8 
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CHAPTER 5 
MEMORY, PORT AND REGISTER COMMANDS 



These commands give access to the contents or current values stored in de- 
signated memory locations, I/O ports and registers. The memory type, maximum 
amount of addressable memory, and total amount of addressable I/O are shown 
below. Note that targets with only one memory type have no distinction be- 
tween program and data memory. For microcontroller versions with multiple 
memory types, refer to section 2.7- 



CPU 


Addressable Memory 


Addressable I/O 


Z80 


OOOOH-FFFFH 


OOOOH-FFFFH 


NSC800 


OOOOH-FFFFH 


OOH-FFH 



MICE-II always checks that memory type and memory/port addresses are valid 
before an operation is performed. References to an invalid address result in 
an error message (ERROR!) being printed and the command ended. MICE-II will 

I/O operations. If there is no memory when executing a memory read operation, 
then data read is random. And if there is nothing connected to the port when 
executing an I/O operation, then data written is lost and data read is random. 

Notes 1) When performing READ/WRITE functions, if external circuitry does 
not respond with the following signal, "TARGET IS NOT READY!!" will 
appear on the console and the contents of the registers will be 
retained. 



Z80 I WAIT 



I NSC800 ! WAIT 1 

However, if the target does not respond when performing READ/WRITE 
functions for MICE-II Z8 or ZS8, incorrect data will be displayed. 

2) A blank space (ASCII 20H) along with a handshaking code (ASCII 03H) 
is sent at the end of each displayed line immediately before the 
cursor for the Assembly, Memory Modify and Register Modity commands. 
This code serves as a an end of data message to the host computer; 
and is provided to help in implementing symbolic debuggers. (Refer 
to page 4-1. ) 
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5.1 Memory Display/Examine/Modify/Fill/Search Command 



M 



Z80/NSC800 - M[start-address[ end-address[ data-l[ data-2[ ...data-8]][ S]]]] 
Z8/ZS8 - M[P|X][start-address[ end-address[ data-l[. .data-8]][ S]]] 



P!X 



start-address 



end-address 



data-1 8 



is the command for Memory Display/Examine/Modify/Fill/Search. 
If no other parameters are specified, inputting "M<CR>" will 
display the next 256 bytes starting at the current PC. 

are memory type designations for microcontrollers indicating 
program memory and external data memory respectively. (Refer 
to section 2.7 for a detailed description of memory types.) 

is a hexadecimal address of the emulation CPU indicating a 
memory location where the operation is to begin. 

is a hexadecimal address of the emulation CPU indicating the 
last memory location of the specified range. 

are hexadecimal or ASCII data. Data in ASCII must be enclosed 
within two apostrophes (e.g. 'AR'). Where a "block fill" or 
"block search" operation is specified, the block may be up to 
8 bytes in hex or 8 characters in ASCII. Combined use of hex 
and ASCII is permitted. If the address range (from start to 
end-address) is smaller than the block size (datal - dataS) , 
then block-fill is still executed but excess trailing data is 
ignored; for block-search however, "MEMORY SEARCH FAILURE!" 
will display. (Note that the apostrophe ['], lower case "r" 
and MICE editing/control characters are not allowed for ASCII 
input . ) 

S defines a "search" option which looks for specified data. 

Where the start and end-address are defined for a memory range in the emula- 
tion processor, the end-address must be greater than or equal to the start- 
address or an error message is printed and the command ends. 
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5.1-1 Memory Display 
M[start-address[ end-address]] 



Input a start and end-address to display the content of a memory range. 
Memory contents are displayed in hexadecimal and ASCII. (Note that data 
without an ASCII equivalent is indicated by a period.) The end-address must 
be greater than or equal to the start-address or an error message is printed 
and the command ends. The display can be terminated by entering an <ESC>. 

Example: Display program memory contents OH to 16H. 

> M0 16 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

0000 31 00 20 DD 21 31 00 CD IB 00 DD 21 5^ 00 CD IB 1. .!1 !T... 

0010 00 DD 21 99 00 CD IB • • ! 

> 

5.1.2 Memory Examine /Modify 

M start-address 

If only the start-address is specified, the content of that memory location 
is first displayed. MICE-II then waits for input. To advance to the next 
memory address, a <CR> should be entered; the next memory location's content 
is then displayed, and MICE-II again waits. To go back to the previous 
memory address a <LF> should be entered; the previous memory location's 
content is then displayed, and MICE-II again waits. Entering a <CR> or <LF> 
repeats the entire sequence. If an <ESC> is entered, the command ends. 

To change the memory content displayed, enter a new value and a <CR> or 
<LF>. (Note that the apostrophe ['], lower case "r" and MICE editing/control 
characters are not allowed for ASCII input.) After writing data to memory, 
verification of memory starts automatically. If any data does not match, the 
following message displays: "MEMORY VERIFICATION FAILURE!". 
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Example: Examine and modify the memory contents from address location lOOOH, 
then display the results. 

> M 1000 

1000 00 31<CR> 

1001 00 'A'<CR> 

1002 00 <LF> 

1001 kl 31<CR> 

1002 00 <ESC> 
> M 1000 lOOF 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 
1000 31 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 

> 

5.1.3 Memory Fill 

M start-address end-address data-l[ data-2[ ...data-8]] 

Input a start and end-address for the memory range to be filled. A specified 
data value or data block may be written into the defined range. 

Example: Write the ASCII value "NEW DATA" to the memory range 1017H to 102FH 
and then display the memory contents for the range lOOOH to 102FH. 

> M 1017 102F 'NEW DATA' 
> M 1000 102F 

00 01 02 03 Ok 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

1000 31 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 

1010 00 00 00 00 00 00 00 4E 45 57 20 44 41 54 4l 4E NEW DATAN 

1020 45 57 20 44 41 54 4i 4e 45 57 20 44 4i 54 41 4e ew datanew datan 
> 
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5.1.4 Memory Search 

M start-address end-address data-l[ data-2[ ...data-8]] S 



Input a start and end-address for the memory range to be searched. A speci- 
fied data value or data block may be searched for within the defined range. 

Example: Search for string "BA 10" in the range lOOOH to 102FH, which is not 
found; then search for string 'NEW in the same address range. 

> M 1000 102F 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

1000 31 31 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 

1010 00 00 00 00 00 00 00 4e 45 57 20 44 4l 54 41 4E NEW DATAN 

1020 45 57 20 44 4l 54 4l 4e 45 57 20 44 4l 54 4l 4e EW DATANEW DATAN 
> M 1000 102F BA 10 S 

MEMORY SEARCH FAILURE! 
> M 1000 102F 'NEW S 

MEMORY MATCH AT ADDRESS 1017 
> 
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5.2 Memory Checksum/Test/Transfer/Compare Command - T 

Z80/NSC800 - T start-address end-address {S|M|address-3[ V]} 
Z8/ZS8 - T[PjX]start-address end-address {SjM|address-3[ V]} 



T 
P!X 



is the command for Memory Checksum/Test/Transfer/Compare. 

are memory type designations for microcontrollers indicating 
program memory and external data memory respectively. (Refer 
to section 2.7 for a detailed description of memory types.) 



start-address is a hexadecimal address of the emulation CPU indicating a 
memory location where the operation is to begin. 

end-address is a hexadecimal address of the emulation CPU indicating the 
last memory location of the specified range. 

S displays the checksum of the contents in the specified range. 

M performs a memory test for the specified range. 

address-3 is a hexadecimal address in the emulation CPU specifying ei- 
ther a destination address, where data is to be transferred, 
or the start of a second memory range used in "block compare" 
(section 5.2.'!} . 

V specifies "block compare" . 

Define the start and end-address for a memory range in the emulation proces- 
sor. The end-address must be greater than or equal to the start-address or 
an error message is printed and the command ends. 
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5.2.1 Memory Checksum 

T start-address end-address S 



An "S" following the range specification causes the checksum to be displayed. 
The checksum is calculated by taking the hexadecimal sum of the contents for 
the indicated range, with carry added back, modulo 256. 

Example: First display the program memory contents for the range 1025H-102AH, 
and then calculate the checksum for the same range. 

> M 1025 102A 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 
1020 54 41 4E 45 57 20 TANEW 

> T 1025 102A S 
THE CHECKSUM IS: AO 
> 

5.2.2 Memory Test 

T start-address end-address M 



An "M" following the range specification causes a memory test to be per- 
formed on the indicated range. The upper-byte and lower-byte of the address 
whose memory is to be tested are exclusive-or'ed (XOR) and written into 
memory for the entire range. The data are verified and then their comple- 
ments are written into the entire range and thoroughly checked again. If the 
comparison fails in either pass, the test is stopped afthe failed address 
and that address is displayed. The original contents in memory are destroy.ed 
in this test. 

Example: Test memory range 1019H through 1023H, displaying the memory con- 
tents for the range lOlOH to 102FH both before and after. 

> M 1010 102F 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

1010 00 00 00 00 00 00 00 4E 45 57 20 44 41 54 41 4E NEW DATAN 

1020 45 57 20 44 41 54 41 4E 45 57 20 44 4l 54 4l 4E EW DATANEW DATAN 
T 1019 1023 M 

RAM OK 
> M 1010 102F 

00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

1010 00 00 00 00 00 00 00 4E 45 F6 F5 F4 F3 F2 Fl FO NE 

1020 CF CE CD CC 4l 54 4i 4e 45 57 20 44 4l 54 4i 4e ....atanew datan 
> 



Example: Test the memory range 3FF0H through ^OOFH, where memory is enabled 
only through 3FFFH. 

> T3FF0 400F M 

ADDRESS (4000) RAM ERROR! 

> M3FF0 400F 

GO 01 02 03 Ok 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 
3FF0 30 31 32 33 34 35 36 37 38 39 3A 3B 3C 3D 3E 3? 0123^56789 : ;<=>? 

4000 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 

> 

5.2.3 Memory Transfer 

T start-address end-address address-3 



An address-3 (dest-address) specification indicates that the memory content 
in the defined range is to be transferred into memory beginning at address-3. 
Data is transferred, one location at a time beginning at the start address 
of the destination range. If the memory ranges defined in the transfer 
command Overlap, the transfer will begin at the end address of the destina- 
tion range to prevent overwrite. 

Example: First display the memory content for the range lOOOH to 102FH, then 
transfer memory content from the range 2000H-202FH to memory begin- 
ning at lOOOH. Finally, display the results of the transfer. 



>M 2000 202F 



00 01 02 03 


04 


05 06 07 08 09 


2000 00 00 00 00 


00 


00 00 00 00 00 


2010 00 00 00 00 


00 


00 00 00 00 00 


2020 00 00 00 00 


00 


00 00 00 00 00 


>T 1000 102F 2000 






>M 2000 202F 







00 01 02 03 04 05 06 
2000 31 31 00 00 00 00 00 
2010 00 00 00 00 00 00 00 



2020 
> 



OF CE CD 



OA OB 00 OD OE OF ASCII-CODE 

00 00 00 00 00 00 

00 00 00 00 00 00 

00 00 00 00 00 00 

OA OB OC OD OE OF ASCII -CODE 

00 00 00 00 00 00 11 

4E 45 F6 F5 F4 F3 F2 Fl FO NE 

CC 41 5^ 41 4e 45 57 20 44 4l 5^+ 41 4e ....atanew datan 



07 

00 



08 09 
00 00 



5-2.4 Memory Compare 

T start-address end-address address-3 V 



A "V" following the address-3 specification executes block compare for the 
indicated memory ranges. The block from start-address to end-address is 
compared with the block beginning at address-3. If comparison is successful, 
"COMPARISON OK!" will display; otherwise the failure addresses along with 
the incorrect data are displayed. 

Example: First display the memory contents from 1000H-102FH and 2000H-202FH, 
then compare these data blocks. 



> M 1000 102F 

00 01 02 03 
1000 31 31 00 00 
1010 00 00 00 00 
1020 CF CE CD CC 
> M 2000 202F 

00 01 02 03 
2000 31 31 00 00 
2010 00 00 00 00 
2020 CF CE CD CC 
>T 1000 102F 2000 



04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

00 00 00 00 00 00 00 00 00 00 00 00 11 

00 00 00 4E 45 F6 F5 F4 F3 F2 F1 FO NE 

4l 54 4l 4e 45 57 20 44 41 54 4l 4e ATANEW DATAN 

04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

00 00 00 00 00 00 00 00 00 00 00 00 11 

00 00 00 4E 45 F6 F5 F4 F3 F2 F1 FO NE 

41 54 41 4e 45 57 20 44 41 54 4l 4e ATANEW DATAN 

V 



COMPARISON OK! 



Example: Compare the data block from lOOOH to 102FH with the address range 
beginning at OH. 



> T 1000 10 2F V 
(1001) =31 
(0001) =00 



; (block 1 failure address) = data 1 
; (block 2 failure address) = data 2 
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5-3 Line Assembly Command - A 
A[start-address] 



A is the command for Assembly. If no other parameters are spe- 

cified, inputting "A<CR>" will execute assembly beginning at 
the current PC. 

start-address is the hexadecimal address in the emulation processor's pro- 
gram memory where MICE begins storing the entered assembly 
language program. (Remember that only emulation program memo- 
ry may be specified for the Z8 and ZS8.) 

Rather than enter programs or program changes in machine code using the pre- 
viously described memory (M) command, the MICE-II resident assembler accepts 
and converts mnemonic inputs into machine code. The converted code is then 
stored in the emulation processor's program memory starting at the indicated 
start-address. The assembler does not recognize symbolic labels or constants 
other than hexadecimal values. The instruction mnemonics accepted are those 
adopted by the original manufacturer for the processor being emulated. In 
addition to these mnemonic codes {listed in the appendices}, the following 
three instructions are also supported during assembly. 

DB - Define Byte (1-6 bytes) 
DW - Define Word (1 word) 
DS - Define Storage (OH-FFFFH) 

DB accepts both hex and ASCII codes, while DW and DS are restricted to hex 
data. (Note that the apostrophe [ ' ] , lower case "r" and MICE editing/control 
characters are not allowed for ASCII input.) If more than 6 bytes are keyed 
in for DB, excess data is truncated on the right and MICE-II displays: 
"WARNING: ONLY 6 BYTES ARE VALID!". If more than 1 word (4 digits) are keyed 
in for DW or DS, the input data is ignored and "ERROR CODE, TRY AGAIN!" is 
displayed. 

After inputting the assembly command, MICE-II displays the following column 
headings : 

>A0 

LOG OBJ LINE LABEL SOURCE CODE 

0000 0001 * 

where the decimal value of 0001 under the column "LINE" indicates the line 
number being entered and the "*" indicates the new cursor position. MICE-II 
then waits for an assembly language line input from the user. The source 
code column consists of an opcode and operand, and must be terminated with 
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either a <CR> or <LF> . MICE-II assembles the line and stores the machine 
code beginning at the indicated start-address. The code for the program 
memory location to be stored is printed under the column "OBJ" . The next 
line number is printed and MICE-II again waits. If an <ESC> is entered 
instead, the command ends. 

MICE-II performs data verification after executing a memory WRITE. If any 
data does not match, the following message displays: "MEMORY WRITE FAILURE!". 
If an invalid program instruction is entered, MICE-II displays: "EE?ROR CODE, 
TRY AC5AIN!". 

Example: Enter a simple program starting at location OH. 



>A0 






LOG 


OBJ 


LINE 


0000 


310020 


0001 


0003 


CDOOOl 


0002 


0006 


DD210030 


0003 


OOOA 


110010 


0004 


OOOD 


lA 


0005 


OOOE 


DD7700 


0006 


0011 


DD23 


0007 


0013 


13 


0008 


0014 


7B 


0009 


0015 


FEOF 


0010 


0017 


C20D00 


0011 


OOIA 


C30000 


0012 


OOID 
> 




0013 


>A100 






LOG 


OBJ 


LINE 


0100 


110010 


0001 


0103 


3E20 


0002 


0105 


12 


0003 


0106 


7B 


0004 


0107 


13 


0005 


0108 


FEOF 


0006 


OlOA 


C20301 


0007 


OlOD 

> 




0008 



LABEL SOURCE CODE 

LD SP,2000 <CR> 
CALL 100 <CR> 
LD IX, 3000 <CR> 
LD DE.IOOO <CR> 
LD A,(DE) <CR> 
LD (IX+0) ,A <CR> 
INC IX <CR> 
INC DE <CR> 
LD A,E <CR> 
CP OF <CR> 
JP NZ.OD <CR> 
JP <CR> 
<ESC> 



LABEL SOURCE CODE 

LD DE.IOOO <CR> 
LD A, 20 <CR> 
LD {DE),A <CR> 
LD A,E <CR> 
INC DE <CR> 
CP OF <CR> 
JP NZ,103 <CR> 
<ESC> 
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Example: An error occurs when an incorrect mnemonic is entered. In 
case, non-hexadecimal data cannot be used in the data field. 



this 



>A E 




LOG OBJ 


LINE 


OOOE 


0011 


ERROR CODE, TRY AGAIN! 




OOOE DD7E00 


0011 


0011 


0012 


> 





LABEL 



SOURCE CODE 
LD A{IX+00) 

LD A,{IX+00) 
<ESC> 



When making changes in an existing program, it is advisable to check the 
program around the modified area using the Disassembly command (section 5.4) 
before and after the change. Rechecking the modified area is important to 
assure that new program changes do not affect the surrounding program. 
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5-4 Disassembly Command - Z 
Z[start-address[ end-address]] 



start- address 



end-address 



is the command for Disassembly. If no other parameters are 
specified, inputting "Z<CR>" will execute disassembly for the 
next 16 lines starting at the current PC. 

is the hexadecimal address in emulation processor's program 
memory where display of disassembled memory content begins. 
{Remember that only emulation program memory may be specified 
for the Z8 and ZS8.) 

is the hexadecimal address in the emulation processor's pro- 
gram memory indicating the last memory location of the range 
to be disassembled and displayed. (Remember that only emula- 
tion program memory may be specified for the Z8 and ZS8.) 

If only the start-address is specified, the content for that memory location 
is disassembled and displayed; more data are then read from subsequent 
locations to complete the instruction if necessary. An end-address speci- 
fication causes the memory contents in the dc ^ined memory range to be disas- 
sembled and displayed. The end-address must be greater than or equal to the 
start-address or an error message is printed (INPUT ADDRESS ERROR) and the 
command ends. If an illegal machine code is encountered, disassembly termi- 
nates at the illegal code's address. 

MICE-II uses a two-pass disassembler with all branch and subroutine call 
addresses first identified and converted to labels; a total of 9OO labels 
can be stored for disassembly. Depending on the range to be disassembled, 
there may be a pause before any data is displayed. 
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Example: Disassemble the previously entered program. Note that the byte 
following the end-address is also read in order to complete the 
instruction for this example. Labels include a prefix (B for branch 
or S for subroutine) and address. 

>Z0 lA 



LOG 


OBJ 


LINE 


LABEL 


SOURCE CODE 


0000 


310020 


0001 


BOOOO 


LD 


SP,2000 


0003 


CDOOOl 


0002 




CALL 


0100 


0006 


DD210030 


0003 




LD 


IX, 3000 


OOOA 


110010 


0004 




LD 


DE.IOOO 


OOOD 


lA 


0005 


BOOOD 


LD 


A.(DE) 


OOOE 


DD7700 


0006 




LD 


(IX+00),A 


0011 


DD23 


0007 




INC 


IX 


0013 


13 


0008 




INC 


DE 


0014 


7B 


0009 




LD 


A,E 


0015 


FEOF 


0010 




CP 


OF 


0017 


C20D00 


0011 




JP 


NZ.OOOD 


OOIA 


C30000 
DISASSEMBLY COMPLEi'KU 


0012 

1 




JP 


0000 



Example: If an illegal machine code is encountered, 
at the illegal code's address. 



disassembly terminates 



>Z1E 31- 


) 








LOC 


OBJ 


LINE 


LABEL 


SOURCE CODE 


OOIE 


110010 


0010 




LD DE.IOOO 


0021 


DDEEOOFE 


0011 


B0021 




> 


ERROR CODE! 
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5-5 Port Input Command - I 
I port[ count [ duration]] 



I is the command for Port Input. 

port is the hexadecimal address of the emulation processor's input port 
that is to be read and displayed. Note that only port 0~3 (0H~3H} 
can be used for MICE-II Z8 and only port 0-4 {DOH-D^IH) can be used 
for MICE-II ZS8. 

count is a hexadecimal value from OOH to FFH specifying the number of 
times the input port is to be read, with OOH indicating 256 times. 

duration is a hexadecimal value from OOH to FFH specifying the interval in 
milliseconds between each read, with OOH indicating 256 milli- 
seconds . 

The input port command has two modes of operation. If neither the count nor 
the duration is specified, a range of port contents can be read and dis- 
played beginning with the indicated port address. 

MICE-II first reads and displays the contents of the port specified and 
waits for input from the user. To advance to the next port, enter either a 
<CR> or <LF>; the next port's content is then read and displayed, and MICE- 
II again waits. Entering a <CR> or <LF> repeats the entire sequence. 

Example: Read and display the contents of ports 8O, 8I and 82. 

>I80 

80 DC <CR> 

81 87 <LF> 

82 FF <ESC> 
> 

Specifying a count with or without a duration interval, MICE-II first reads 
from the specified input port the number of times indicated and then dis- 
plays the contents. 

Duration defines the interval between each read in milliseconds, permitting 
compensation for data inputs which are time critical. If no interval is 
specified, then data is read at one millisecond intervals. 
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Example: Read and display the next 64 (40H) values for port DOH at 10 (OAH) 
millisecond intervals. 

> IDO 40 A 

PORT 00 01 02 03 04 05 06 07 08 09 OA OB OC OD OE OF ASCII-CODE 

DO 36 22 AE 9B 2B 18 07 77 26 d6 86 35 E5 95 44 f4 6". .+. .w&. .5. .e 

A3 53 03 B2 62 12 CI 71 20 DO 8O 2F DF 8E 3E EE .S..b..q ../..> 

9D RD FD AC 5C OB BB 6B 1A CA 7A 29 09 88 38 E8 .M. .\. -k. .z) . .£ 

97 47 F6 A6 56 05 B5 65 14 C4 73 23 D3 82 32 EG .G. .V. .e. .s#. .2 



Note that the interval can be up to 256 milliseconds (approximately a quar- 
ter of a second). If the number of times the port is to be read is also 256, 
the elapse time before any data is displayed is approximately 65 seconds. 
Therefore, to end the command before display begins, enter an <ESC> . 



5-16 



5.6 Port Output Command - 

port data-l[ data-2[ ...data-8]] 



is the command for Port Output. 

port is a hexadecimal address of the emulation processor's output 
port. Note that only port 0~3 (0H~3H) can be used for MICE-II Z8 
and only port 0-4 (DOH~Di|H) can be used for MICE-II ZS8. 

data-1...8 are hexadecimal values to be written into the specified output 
port of the emulation processor in sequential order. 

If only one value is specified, it is written to the indicated output port. 
If more than one value is specified, each value is written to the indicated 
port at one millisecond intervals with the first value going out immediately. 

Example: Write the value ^BH to port OIH. 

> 1 IxR 
> 

Example: Write values 1, 2 and 3 to port 05H. Value 1 is written immediately 
followed by value 2 after one millisecond and va?ue 3 after another 
millisecond. 

> 5 1 2 3 
> 
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5.7 Reset/Initialization Command - X 
X[ address] 



X is the command for Reset/Initialization. 

address is a hexadecimal addresses in the emulation CPU's program memory 
where emulation is to begin. (MICE-II Z80 and NSC800 do not support 
an optional address.) 

A signal pulse is generated on the appropriate pin of the emulation proces- 
sor to reset it. The processor's program counter, internal registers and 
flags are all altered. A start address can be defined which sets the emu- 
lation processor's program counter to the specified program memory address. 
Only the emulation processor is reset; any logic or peripherals connected to 
the target input reset pin are not affected. 

In addition, control and interrupt signals to the emulation processor that 
are selectively controllable by the Disable and Enable commands are acti- 
vated if MlCE-11 is connected to a power-applied target system. If no target 
system is connected to MICE-II, those signals will be disabled. 

Example: Reset a emulation processor, showing changes in the program counter 
(PC) and registers before and after. 

>R 

ABCDEHLIF X YSPC 
FF F7 FE FD EF FB FF 00 FF FFFF FEFF FFFB 0010 
>X 
>R 

ABCDEHLIF X YSPC 

FF F7 FE FD EF FB FF 00 FF FFFF FEFF FFFB 0000 
> 
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5.8 Register Display /Modify Command - R 

5.8.1 Register Command for MICE-II Z80 and NSCBOO 

R[ register] 



register 



is the command for Register Display /Modification. 

is an alphabetic character indicating the target register whose 
content is to be displayed or modified. The Z80 and NSC800 have 
two sets of registers that may be displayed or changed with the R 
command. Input "R" to select the current set or "HP" to select the 
alternate set. The register set that can be displayed and changed 
by the R command is listed in the following table; where alter- 
nates are available, they are listed under the mnemonic heading 
with an appostrophe. 



Mnemonic 


Register 


Contents 


A A' 


Accumulator 


8 bits 


B B' 


General Purpose 


8 bits 


C C 


General Purpose 


8 bits 


D D' 


General Purpose 


8 bits 


E E' 


General Purpose 


8 bits 


H H' 


General Purpose 


8 bits 


L L' 


General Purpose 


8 bits 


I 


Interrupt Mask 


8 bits 


F F' 


Flags 


8 bits (6 flags) 


X 


Index IX 


16 bits address 


Y 


Index lY 


16 bits address 


S 


Stack Pointer 


l6 bits address 



5.8.1.1 Display Registers 
R 



All register contents are displayed if no specific register Is defined. Note 
that the displayed value of the program counter (PC) always Indicates the 
address for the current instruction's opcode. 

Example: Display register contents. 

>R 

ABCDEHLIF X YSPC 
FF F7 FE FD EF FB FF 00 FF FFFF FEFF FFFB 0000 
> 
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5.8,1.2 Modify Registers 
R register 



If a register is specified, the content of that register is first displayed; 
MICE-II then waits for input. To advance to the next register enter either a 
<CR> or <LF>; the next register's content is then displayed and MlCE-II 
again waits. Entering a <CR> or <LF> repeats the entire sequence unless the 
next register to display is "PC", The J command (section 5.9) must be used 
to change the program counter. If an <ESC> is entered, the command ends. To 
change the content of the displayed register, enter a new value in hex or 
ASCII (enclosed with two apostrophes, e.g. 'A') and <CR> or <LF> . 

Example: Examine the specified register and change its content. 

>RA 

A FF 02<CR> 

B F7 03<CR> 

C FE <ESC> 
>R 

ABCDEHLIF X YSPC 

02 03 FE FD EF FB FF 00 FF FFFF FEFF FFFB 0000 
> 
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5-8.2 Register Command for MICE-II Z8 
R[P|G|Wlal[ a2[ dl[..d8]]]] 



MICE-II Z8 has three sets of registers: 

R displays all register contents. 

RP displays control or peripheral register contents. 

RG displays general purpose register contents {4H-7FH) . 

RW displays working register contents (l6 bytes within OH- 

7FH where the start-address is OH or a multiple of lOH) . 
The pointer can be set by the user program or by modify- 
ing register "FD". If the register pointer is at an 
unused range (SOH-EOH) , working register contents will 
display as " — ". 

Ral[ a2[ dl[..d8]] can display, modify or fill general purpose registers. 
Note that 4H<al<a2<7FH, See section 5.1 for more infor- 
mation on addresses {al-a2) and data (dl-dS) . 

Example: Display all control and peripheral register contents. The current 
PC is shown as OOOC. Note that "--" indicates write only registers. 

>RP 

PC SIO TMR Tl PRl TO PRO P2M P3M POl IPR IRQ IMR FLG RP SPH SPL 
FO Fl F2 F3 F4 F5 F6 F7 F8 F9 FA FB FC FD FE FF 

OOOC 00 50 00 — FF — — — — — 00 36 89 20 3k 56 
> 

Example: Display all general purpose register contents. "WR" indicates work- 
ing registers. Note that "**" indicates I/O registers. 

>RG 

OI23456789ABCDEF 

RO ** *♦ *» ** 01 01 01 01 01 01 01 01 01 01 01 01 

Rl 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 12 

WR OA 31 OC E3 00 BF 46 23 23 23 23 78 DA OE 23 23 

R3 34 34 3^ 34 34 3^^ 34 34 34 34 34 3^ 34 34 3^ 34 

r4 45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 45 

R5 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 56 

R6 67 67 67 67 67 67 67 67 67 67 67 67 67 67 67 67 

R7 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 78 
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Example: Display working register contents with the register pointer (RP) 
set to 20H. 

>RW 

RP 0123^56789ABCDEF 

20 OA 31 OC E3 00 BF k6 23 23 23 23 78 DA OE 23 23 
> 

Example: Modify the contents of register "F8". 

> RF8<CR> 

rf8 ff 96<cr> 

RF9 FF <ESC> 
> 
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5-8.3 Register Command MICE- II ZS8 
R[Rn!Fflag]!G[ al[ a2[ dl[. .dS]]]] !S[[Oll]al] 



R displays working register contents (l6 bytes within 

OOH-FFH) . The pointer can be set by the user program or 
by modifying registers D7H/D6H. The contents of re- 
served registers and "write only" registers are dis- 
played as "--", while the contents of port registers 
are displayed as "**". 

RRn permits modification of working registers. 

RFflag permits modification of flag register with binary input. 

RG displays general purpose register contents {OOH-FFH) . 

RG al[ a2[ dl[..d8] can display, modify or fill general purpose registers. 

RS displays contents of special purpose registers, includ- 

ters (EOH-FFH), and registers COH-CFH (used as working 
registers only) . 

RS[Ojl]al permits modification of special purpose registers, 

where [Ojl] indicate bank selection. 

See section 5.I for more informationon addresses (al-a2) and data (dl-dS) . 

Example: Display working register contents with the register pointers RPO 
and RPl set to COH and C8H respectively, and the PC set to 0020. 
Also note that the flags "CZSVDHFB" are displayed with binary data. 

>R 

RPO(CO) R0=55 R1=AA R2=A2 R3=55 R4=75 R5=AA R6=AA R7=55 CZSVDHFB PC=0020 

RP1(C8) R8=55 R9=FA RA=AA RB=55 RC=77 RD=AE RE=AB RF=75 OIOIOOOO 

> 

Example: Modify working register R8. 

> RR8<CR> 
r8 55 aa<cr> 
r9 fa <esc> 
> 
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Example: Modify the content of the flag with binary input (1 or 0). 

>RFC 

C <CR> 
Z 1 0<CR> 
S 1<CR> 
V 1 <ESC> 
> 

Example: Display all general purpose register contents. 

>RG 

OI23456789ABCDEF 

RGO 55 A2 AA 15 57 BA AA d6 55 A8 AA 5C 55 BE AE F5 

RGl 55 AA AA 55 55 AA AA F5 45 AA AA I5 55 AA AA 55 

RG2 45 AA AA 55 7F AE 2B D7 55 AA EA 55 55 AA AB F5 

RG3 54 AA AA 55 55 AF 9A 55 55 AA AA 55 D5 BB AA 55 

RG4 15 AA A2 55 5D BA EE 57 55 88 AA 51 57 BA EA 5D 

RG5 55 AA 8A I5 5D AA A9 55 55 8A AA 55 57 AA A2 5F 

RG6 55 AA OA 55 57 AB FA D5 5I 2A AA 84 75 FA BA 55 

RG7 55 AA AA I5 57 AB AA 5D 51 22 AA I5 75 AB AA 55 

RG8 55 A8 AA 55 55 BB AA 55 4l A2 A2 40 5F BA BB 5D 

RG9 55 AA AA 55 75 BA AA 75 55 AA AA 70 D5 AA AE D5 

RGA 71 AA AE 55 D5 EA BA 57 55 2A A2 55 55 BE BA 55 

RGB 55 AA AA D5 D5 AE AA 55 55 AA AA 55 D5 BE AA D5 

RGO 51 AA A8 55 55 EA FA 5D 55 AA 8A 45 75 AA AA D5 

RGD 55 8A AA 55 55 AA AA 55 57 AA 8A 55 55 AB EA D5 

RGE 45 AA 8A 55 55 2A AA 5D 55 AA AA D5 7D FE AE 5D 

RGF 55 AA AA 55 55 FB EB F5 D5 AA AA 75 57 FA AA 55 

Example: Modify the contents of general purpose register "I5". 

> RG15<CR> 

RGl 5 AA 33<CR> 

RG16 AA <ESC> 
> 
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Example: Display all special purpose register contents. Note that the symbol 
"--" indicates write only registers. 

>RS 

CO CI C2 C3 C4 C5 C6 C7 C8 C9 CA CB CC CD CE CF 

55 AA A2 55 75 AA AA 55 AA FA AA 55 77 AE AB 75 

SYSTEM REGISTERS: 

FLAG RPO RPl SPH SPL IPH IPL IRQ IMR SYM 
D5 D6 D7 D8 D9 DA DB DC DD DE 
30 CO C8 00 00 00 00 00 00 60 

MODE AND CONTROL REGISTER: 

BANK REGISTERS 

COCT CICT COCH COCL CICH CICL UTC CRC UIE UIO POM PM 
EO El E2 E3 E4 E5 EB EC ED EF FO Fl 
OA 08 00 00 00 00 02 00 00 00 00 

HOC HlC P4D P40D P2AM P2BM P2CM P2DM P2AI P2BI EMT IPR 

Fk F5 f6 F7 f8 f9 fa fb fc fd fe ff 
FF 00 -- -- -- -- 00 00 70 00 



BANK 1 REGISTERS 

COM CIM COTH COTL CITH CITL DCH DCL 
EO El E2 E3 E4 E5 FO Fl 
20 00 00 00 00 00 00 00 

> 



UBGH UBGL uma UMB wumc wums 
f8 f9 fa FB FE FF 
00 00 00 00 00 00 



Example: Modify the contfents of the system register or registers CO-CF (used 
as working registers only) . 

> RSCO<CR> 
RSCO 55 11<CR> 
RSCl AA <ESC> 
> 

Example: Modify the contents of mode^ and control register in BANKl at E2. 

> RS1E2<CR> 
RS1E2 00 FF<CR> 
RS1E3 00 <ESC> 
> 
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5.9 Jump/Branch Conunand - J 
J address 



J Is the command for Jump/Branch. 

address is a hexadecimal address of the emulation processor's program mem- 
ory where the program counter is to be set. 

Changing the emulation processor's program counter causes subsequent emula- 
tion to continue from that address in program memory space. 

Example: Change the program counter from the current address to 5H. 

>J6 
>R 

ABCDEHLIF X YSPC 
02 03 FE FD EF FB FF 00 FF FFFF FEFF FFFB 0006 
> 
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CHAPTER 6 
CONTROL SIGNAL COMMANDS 



These commands enable or disable specific control signals going to the emu- 
lation processor. The available signal is either enabled or disabled at the 
input pin on the emulation processor. Only sense input to the processor is 
affected; circuits which generate the control signal in the target system 
are unaffected. The control characters and signal designation for hardware 
control signals (including pin numbers) and software control signals that 
are affected by the Disable and/or Enable commands are listed below: 





Signal Designation 


z8o 




NSC800 


z8 




ZSS 


B - 


Bus Hold Request 


BlTSRQ - 


25 
23 


BREQ - 36 
BACK - 35 










BUSAK - 




I - 


Interrupt Request 


INT 


16 


RSTA - 22 
RSTB - 23 
RSTC - 24 
INTR - 25 


IRQO - 
IRQl - 
IRQ2 - 
IRQ3 - 


12 

30 

39 

5 




N - 


Non-Maskable Interrupt Request 
System Reset 


NMl 


17 
26 


NMI - 21 


RESET - 


6 




R - 


RESET - 


RESET - 26 (40-pin) 
















30 (48-pin) 


X - 


Specify Program Memory 
and Data Memory Space 








* 




» 



* 1) This is a software control function; no pin signals are affected. Emu- 
lation memory (HUEM/UEM) is configured by using the following commands. 

DX - combined memory space 
EX - segregated memory space 

2) A/Z/M/T/U and Download commands are not affected by EX or DX. 

3) After power-up, or reset by the X command, MICE is set to DX mode (i.e. 
external memory space is combined) . 
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Notes 1) MICE-II NSCS OO - to control emulation of the processor, MICE shares 
the use of WAIT input {pin-38) , pulling the signal low to suspend 
emulation. 

2) MICE-II Z8 - D and E commands cannot control internal interrupt. 

3) MICE-II ZS8 - D and E commands cannot control internal or external 
interrupt. 
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6.1 Enable/Display Control Signal Command - E 
E[ control-signal] 



E is the command for Enable. If no signals are specified, key- 

ing in "E" will display the control signals that are enabled. 

control -signal is a single alphabetic character indicating a control signal 
to the emualtion processor. 

The control signal specified is activated at the pin of the emulation pro- 
cessor. When resetting the processor with the X command {section 5-1), these 
signals are not activated unless MICE is connected to a power-applied target 
system. 

Example: Activate interrupt request control signal. 

> E I 
> 

Example: Display the enabled control signals. 

>E 

ENABLE -INT 

> 
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6.2 Disable/Display Control Signal Command - D 
D[control-slgnal] 



D is the command for Disable. If no signals are specified, 

keyingin "D" will display the disabled control signals. 

control-signal is a single alphabetic character indicating a control signal 
to the emulation processor. 

The control signal specified is deactivated at the pin of the emulation pro- 
cessor. When resetting the processor using the X command (section 5-7). 
these signals are activated if MICE is connected to a power-applied target 

system. 

Example: Deactivate the interrupt request (INT) control signal, thereby not 
processing any interrupts which may occur. Note that this command 
does not affect the interrupt mask list in the processor status 
register. 

>DI 
> 

Example: Display the disabled control signals. 

>D 

DISABLE -NMI 

-INT 
-DMA 
-RESET 
> 
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CHAPTER 7 
EMULATION AND TRACE CONTROL COMMANDS 



These commands perform free-running emulation or tracing for the emulation 
processor in real time. Program operation may be recorded with user defined 
trigger addresses to specify the start or end of tracing. Up to 20^8 machine 
cycles can be recorded. 

Status information displayed by these commands use the following column 
headings: "IFADDR ADDRESS DATA STATUS SPARE (8 BITS)" 

where: IFADDR is the instruction fetch address. 

ADDRESS is the hexadecimal value on the address bus. 

DATA is the hexadecimal value on the data bus. 

STATUS is the type of processor activity. 

SPARE is the status of the headers on the personality (CEP) board. 

The specific types of processor activity that can be displayed in the status 
column are indicated below. The mnemonics listed for each processor also 
serve as qualifiers for H/F/B/L and BPP commands, as well as being displayed 
as statuses for C/SZ commands. 



CPU Statuses 




z80 


NSC 


Z8 


ZS8 


Instuction Fetch Cycle 




S 


S 


S 


S 


Memory Read Cycle 




R 


R 


R 


R 


Memory Write Cycle 




W 


W 


W 


W 


Port Input 




I 


I 






Port Output 














Interrupt Acknowledge 




A 


A 






Interrupt Cycle, Instruction Fetch 






AS 




Interrupt Cycle, Memory 


Read 






AR 


AR 


Interrupt Cycle, Memory 


Write 






AW 


AW 



The following status designators apply only for the MICE-II Z80 and NSC800. 

1) The statuses "E" and "?" may , be displayed for Cycle/Instruction Step and 
List Trace commands; where '^^ indicates a second opcode fetch cycle, and 
"?" indicates either a first or second opcode fetch cycle which MICE-II 
cannot distinguish. Remember that these statuses cannot be used as quali- 
fiers for command specification. 

2) When selecting "S" activity as a qualifier in the List Trace command, the 
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2) When selecting "S" activity as a qualifier in the List Trace command, the 
displayed messages will include "S" , "E" and "?" qualifiers. 

3) When using a qualifier in the Halt or Trace commands, if the breakpoint 
or trigger address is at the second opcode, then the qualifier "S" should 
be specified. 



Trace point connections are also provided for monitoring external signals. 
There is a 8 post stick header on the CEP board designated X0-X7 from right 
to left. Any cable or wiring can be used to connect from these test points 
to the target. The monitored signals are called spare bits and support con- 
current trace for the address, data and status bus. Any of these bits 'can be 
monitored by trace commands to provide hardware status for display (under 
the SPARE column) in List, Cycle Step and Instruction Step commands; where 
"1" represents a high (or floating) signal and "0" indicates a low signal. 



7-2 



7.1 Go/Execution Command - G 
G[address] 



G is the commgind for Go/Execution. 

address is a hexadecimal address of the emulation processor's program memo- 
ry where emulation will begin. 

The emulation processor's program counter is first set to the address indi- 
cated. MICE-II then starts realtime emulation of the target processor. If no 
address is specified, program emulation will start at the current program 
counter . 

Example: Display register content (PC=0006H) , and start emulation from ad- 
dress OH. 

>R 

ABCDEHLIF X YSPC 

02 03 FE FD EF FB FF 00 FF FFFF FEFP FFFB OOO6 
>G0 
> 



Example: Display register content, and resume emulation from the current PC. 

>R 

ABCDEHLIF X YSPC 

20 03 FE 10 5D FB FF 00 02 0099 FEFF IFFA OIO8 

>G 

> 

Note: ?/!/D/E/L/BS* commands may be input without halting emulation, while 
the processor is executing G/FR/BR commands, or while executing F/B 
commands after the trigger has been matched. (* BS is a BPP command.) 
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7-2 Halt/Breakpoint Set Command - H 

H[0[l|2]|l [addx[ count[ qualif ier] ] ] ! 2 [address-2]] 

H is the command for Halt/Breakpoint Set. 

is the command to clear a breakpoint. 

1 is breakpoint 1. 

2 is breakpoint 2. (Count, qualifier and wildcard do not apply.) 

addx is an up to 4 digit hexadecimal address setting for breakpoint 1, 
with a wildcard byte pair of "XX" or "XXXX". 

coiuit is a hexadecimal value from 1 to 4000H which specifies the number 
of times the indicated condition must be matched before emulation 
stops. 

qualifier is a single alphabetic character indicating the type of processor 
activity to be selected. 

address-2 is an up to 4 digit hexadecimal address setting for breakpoint 2. 
(No wildcard, count or qualifier is permitted.) 

7.2.1 Halt 

H 



Input "H" during emulation or tracing to stop execution immediately and 
display the current address. 

Example: Stop emulation and display the current address. 

>G 

>H 

PROGRAM BROKE AT ADDRESS 0106 
> 



7-^+ 



7-2.2 Set Breakpoint 

H l[addx[ count [ quallf ier] ] ] 1 2 address-2 



MICE-II supports two realtime breakpoints. Breakpoint 1 can be used to 
specify a program address where emulation will stop. A count may also be 
specified to define the number of times the indicated condition is to be 
matched before emulation stops. If no count is specified, the default is one 
and emulation stops at the first breakpoint address matched. A qualifier can 
also be selected to choose the type of processor activity which must be 
matched along with the breakpoint address and count to stop emulation. If no 
qualifier is specified, all machine cycles are chosen. To enter a qualifier, 
a count must first be defined. 

Breakpoint 2 can be used to specify a program address where emulation or 
tracing will stop. When setting breakpoint 2, set the breakpoint address 

only. 

Example: Set breakpoint 1 to address 7H and count to 1. 

> H1 7 1 
> 

Example: Set breakpoint 2 to address IBH. 

> H2 IB 
> 

Breakpoints 1 and 2 only set breakpoint conditions. Unless the emulation CPU 
is in execution, an emulation or trace command must be input to start the 
CPU. If HI or H2 is matched, MICE-II will stop the emulation processor and 
display the current address {at the specified breakpoint address). Break- 
point 1 will reset automatically after the Trace command since it shares the 
same logic as the Forward/Backward Trace commands. Note that breakpoints are 
not active in Cycle Step and Instruction Step commands. 

Note: For MICE-II Z8 and ZS8, when the breakpoint is matched, the CPU will 
finish executing the current instruction cycle and stop at the opcode 
fetch of the next instruction. 
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Example: Set an emulation program at OH; then set breakpoint 1 to 3H, count 
to 1, qualifier for instruction fetch cycle (S) , and breakpoint 2 to 
IBH. 

>J0 

> H1 3 1 S 

> H2 IB 

>G 

PROGRAM BROKE AT ADDRESS 0003 

> 

Note: Z80 (WAIT mode) will display: "PROGRAM BROKE AT ADDRESS XXXX". 

Example: Set the breakpoint address to XXFFH, the count to 1 and qualifier 
for memory write cycle (W) . 

> H1 XXFF 1 W 

PROGRAM BROKE AT ADDRESS IFFE 
> 



7-2.3 Display Breakpoint 
H 1|2 



Input Hi or H2 to display breakpoint 1 or breakpoint 2 messages respectively. 

Example: Display breakpoint 1 and 2 messages. Note that the address, count 
and qualifier are displayed for breakpoint 1; and only address is 
displayed for breakpoint 2. 

>H1 

Hl= XXFF 1 W 

>H2 

H2= IB 

> 
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7-2.4 Clear Breakpoint 
H 0[1|2] 



MICE-II can clear all breakpoints concurrently or separately. 

Example: Clear breakpoint 1 only. 

> H01 
>H1 
Hl= 
> 



Example: Clear all breakpoints concurrently. 

>H0 
>H1 
Hl= 
>H2 



/-/ 



7-3 Forward Trace Command - F 
F[R]addx[ coxmt[ qualifier]] 



F is the command for Forward Trace. 

R continues running the emulation processor after the trace stops. 

addx is an up to 4 digit hexadecimal trigger address with a wildcard 
byte pair of "XX" or "XXXX" where MICE~II begins recording trace 
information . 

count is a hexadecimal value from 1 to 4000H which specifies the number 
of times the target condition must be matched before the trace 
records information. 

qualifier is a single alphabetic character indicating the type of processor 
activity that must be matched with the trigger address. 

Forward tracing starts realtime emulation of the target and begins record- 
ing target status information when the trigger condition is matched. Forward 
trace will stop when the trace buffer is full or breakpoint 2 is reached. 
Forward trace can record up to 2048 machine cycles. 

When the trace stops, MICE halts the emulation CPU at the bresik address. The 
recorded information can be examined by using the List Trace Buffer command. 

Note: For MICE-II Z8 and ZS8, when the breakpoint is matched or the trace 
buffer filled, the CPU will finish executing the current instruction 
cycle and stop at the opcode fetch of the next instruction. 

Option R allows the emulation CPU to continue running after the trace stops 
but breakpoint 2 will force the CPU to stop. Without option R, the CPU will 
stop whenever the trace stops. If only the trigger address is specified, all 
machine cycles after that trigger address is encountered are recorded. If a 
count is specified, the trace will record information after the number of 
matches of the indicated trigger condition occur. If no count is specified, 
the trace will begin recording information as soon as the trigger condition 
is matched. 

A single qualifier may be specified to choose the type of processor activity 
associated with the trigger address; default is for all machine cycles. To 
enter a qualifier, a count must first be defined. When specified, the trace 
will start recording only when the trigger address together with the quali- 
fier occurs the number of times defined by count. 
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Example: Begin recording program status from the trigger address of 3H. In 
the following message, STEP indicates the last trace frame recorded. 
The trace count begins at zero, so the actual value is one more 
than the step number shown. The trace buffer is completely filled 
if STEP 07FF is displayed. 

>F2 

THE TRACE STOPS AT STEP 07 FF 

> 

Depending on command specifications, the elapse time before the buffers fill 
may be long. Entering <ESC> terminates the trace, yet retains the informa- 
tion already recorded. 

Example: Specify a trigger address of 112H which the program never reaches; 
the trace buffer is emptied. Note that if breakpoint 2 is encoun- 
tered before the trigger address is reached, the message will be 
displayed without entering <ESC> . 

> F112 

<ESC> 

FORWARD TRACE FAILS 

> 

Example: Begin tracing when the memory location 2H is addressed and stop at 
breakpoint 2 before the trace buffer is filled. 

>J0 
>H2 7 



>F2 

THE TRACE STOPS AT STEP OOBD 
PROGRAM BROKE AT ADDRESS 000? 
> 



Y-y 



Example: Begin recording status information the first time the program 
writes to an address in the range of IFOOH to IFFFH. Continue run- 
ning after the trace stops until the program addresses OOIBH. Note 
that qualifiers are only associated with the trigger address; all 
machine cycles are recorded after the trace has begun. 

>J0 

> H2 IB 

> FR IFXX 1 W 

THE TRACE STOPS AT STEP OlAl 

PROGRAM BROKE AT ADDRESS OOIB 

> 
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"J.k Backward Trace Command - B 
B[R]addx[ count[ qualifier]] 



B is the command for Backward Trace. 

R continues running the emulation processor after the trace stops. 

addx is an up to 4 digit hexadecimal trigger address with a wildcard 
byte pair of "XX" or "XXXX" where emulation is to stop. 

count is a hexadecimal value from 1 to 4000H which specifies the number 
of times the target condition must be matched before the trace 
stops recording information. 

qualifier is a single alphabetic character indicating the type of processor 
activity that must be matched with the trigger address. 

Backward tracing starts realtime emulation of the target and immediately 
begins recording target status information until the trigger address or 
breakpoint 2 is reached. When the trace is matched, MICE-II halts the emula- 
tion processor at the specified break address. 

Note: For MlCE-II Z8 and ZS8, when the breakpoint is matched or the trace 
buffer filled, the CPU will finish executing the current instruction 
cycle and stop at the opcode fetch of the next instruction. 

Backward trace can record up to 2048 cycles and the recorded information can 
be examined using the List Trace Buffer command. If more than 2048 cycles 
elapse before backward tracing ends, only the last 2048 cycles are recorded. 
Option R allows the emulation processor to continue running after the trace 
stops, however breakpoint 2 will force the CPU to stop and display a break- 
point match message. 

Without option R, the CPU will stop whenever the trace stops. If only the 
trigger-address is specified, all machine cycles are recorded up to and 
including the trigger-address encountered. If a count is specified, backward 
tracing will record all information before the number of matches of the 
indicated trigger-address. If no count is specified, the trace will stop 
after the first match. 

A single qualifier may be specified to choose the type of processor activity 
associated with the trigger-address. To enter any qualifier, a count must 
first be defined. 
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Example: Begin tracing immediately and stop when the memory location IBH is 
addressed. Note that the trace will also stop when breakpoint 2 is 
encountered . 

>J0 

> H2 7 

> B1B 

THE TRACE STOPS AT STEP OOBF 

PROGRAM BROKE AT ADDRESS 0007 

> 

In the above example, the breakpoint message following the command line in- 
dicates that 07H cycles have been recorded. The counter is a hexadecimal 
value from to 7FFH. The trace count begins at zero, so the actual value is 
one more than the step number shown. 

Again, depending on the specification, elapse time before the trigger ad- 
dress is encountered may be long. Entering an <ESC> terminates the trace, 
yet retains the information already recorded. 

Example: Specify a trigger address of 112H which the program never reaches. 
The trace buffer is filled with the cycles immediately before <ESC> 
is received. 

>H0 

> B112 

<ESC> 

THE TRACE STOPS AT STEP 07FF 

> 

Example: Begin tracing immediately and stop the 1st time the program reads 
from the address range of IFOOH to IFFFH. Continue running after 
the trace stops, until the program addresses GOIBH. Note that qual- 
ifiers are only associated with the trigger address; all machine 
cycles are recorded once the trace begins. 

>J0 

> H2 IB 

> BR IFXX 2 W 

THE TRACE STOPS AT STEP 0007 

PROGRAM BROKE AT ADDRESS OOIB 

> 
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7-5 List/Display Trace Buffer Command - L 

L[step[ address-l[ address-2[ qualifler{s)]]] |S[step] lZ[step] IN] 



L 
step 



is the command for List/Display Trace Buffer. 

is a hexadecimal value from to 7FFH indicating the initial 
cycle step to display. 



address-l is the starting address of the range to be listed. 

address-2 is the ending address of the range to be listed. 

qualifier{s) are single characters indicating the type of processor activi- 
ties to list. 

S lists the trace buffer using mnemonic code. 

Z lists the trace buffer displaying mnemonic code and all machine 

statuses . 

N displays the frame number where the last trace stopped. 

Status information recorded during a trace command is displayed using this 
command. If a step is specified, MICE-II lists the trace buffer from the 
specified step to the last recorded step. If no step is specified, MICE-II 
will list all records in the trace buffer. An optional address range can be 
entered to specify the range to be listed. If no address range is specified, 
then the display range is from OOOOH to FFFFH. 

The type of information to be listed is specified by entering qualifier{s) . 
If no qualifier is entered, all machine cycles within the specified address 
range are listed. To enter a qualifier, an address range must first be 
defined. To enter an address range, a step must first be entered. The List 
command accepts multiple qualifiers; and displays only machine cycles that 
match the specified qualifiers. If the buffer is listed with the LS or LZ 
command, only "step" can be specified. 
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Example: List all records in the trace buffer. Note that the list operation 
can be terminated by entering an <ESC> . Note that FT?AME is the 
sequence number of the trace step in hexadecimal; the range is to 
2047 (7FFH). 

>L 
FRAME IFADDR ADDRESS DATA STATUS SPARE (8 BITS) 



0000 




0000 


31 


? 


11111111 


0001 




0001 


00 


R 


11111111 


0002 




0002 


20 


R 


11111111 


0003 


0003 


0003 


CD 


S 


11111111 


0004 




0004 


00 


R 


11111111 


0005 




0005 


01 


R 


11111111 


0006 




IFFF 


00 


W 


11111111 


0007 

> 




IFFE 


06 


W 


11111111 



Example: List the trace buffer from the 3th step to the last step, and 
terminate the operation before the listing is completed. 

>L2 
FRAME IFADDR ADDRESS DATA STATUS SPARE (8 BITS) 



0002 




0002 


20 


R 


11111111 


0003 


0003 


0003 


CD 


S 


11111111 


0004 




0004 


00 


R 


11111111 


0005 




0005 


01 


R 


11111111 


0006 




IFFF 


00 


W 


11111111 


0007 

> 




IFFE 


06 


W 


11111111 



Example: List the trace buffer write cycles in the range 3H to 5H starting 
at step 2. 

>L2_J_5 
FRAME IFADDR ADDRESS DATA STATUS SPARE (8 BITS) 

0003 0003 CD S 11111111 

0004 0004 00 R 11111111 

0005 0005 01 R 11111111 
> 
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Example: List the trace buffer from OH to FH, with qualifier S. 

> L0 F S 
FRAME IFADDR ADDRESS DATA STATUS SPARE {8 BITS} 
0000 0000 31 ? 11111111 
0003 0003 0003 CD S 11111111 



Example: List trace message with source code; the operation is terminated 
before the listing is completed. Note that the command also ends if 
the trace buffer is empty or if nothing is recorded within the 
specified range. 



>LS 
FRAME IFADDR ADDRESS DATA 
0000 0000 0000 31 
0003 0003 0003 CD 

> 



SOURCE CODE 
LD SP,2000 
CALL 0100 



Example: List trace message with mnemonic code and all 
then display the frame number of the last trace. 



machine statuses ; 



>LZ 



FRAME II 


?ADDR A 


DDRESS 


DATA S' 


TATUS 


SPARE 


SOURCE CODE 


0000 




0000 


31 


? 


11111111 




0001 




0001 


00 


R 


11111111 




0002 




0002 


20 


R 


11111111 




0003 


0003 


0003 


CD 


S 


11111111 


CALL 0100 


0004 




0004 


00 


R 


11111111 




0005 




0005 


01 


R 


11111111 




0006 




IFFF 


00 


W 


11111111 




0007 
> 

>LN 




IFFE 


06 


W 


11111111 
















THE TRACE STOPS 
> 


AT STEP 0007 
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CHAPTER 8 
STEPPED EMULATION COMMANDS 



These commands perform cycle-stepped or instruction-stepped emulation of the 
emulation processor in real time. Note that breakpoints are not active for 
C/S commands. Refer to page 7"! for a description of the displayed status 
information. 

Note: A blank space (ASCII 20H) is sent at the end of each displayed line 
immediately before the cursor for C/S commands. This code serves as a 
an end of data message to the host computer; and is provided to help 
in implementing symbolic debuggers. 



8.1 Cycle Step Command - C 
C[count] 



C is the command for Cycle Step. 

count specifies the machine cycle interval between displayed messages. The 
range is 0-FFFFH. Note that an input value of "0" represents lOOOOH. 

The Cycle Step command first stops the emulation processor, then steps and 
executes one program one cycle, stopping the processor in HALT state (where 
the displayed target status has already been executed) . MICE-II then awaits 
a <CR> or <LF> to execute and display the next machine cycle. Enter a <CR> 
or <LF> to repeat the entire sequence, or an <ESC> to terminate the single- 
cycle mode of emulation. 

Because the Z8 and ZS8 cannot be stopped, MICE keeps the CPU running in 
place with a jump instruction, where the displayed instruction (including 
all associated machine cycles) has already been executed. 

However, note that the ZBO (WAIT Mode) stops the emulation processor at WAIT 
state instead, where the displayed cycle status has not yet been executed. 

Because the displayed status is still active in this situation, debug for 
associated hardware signals is simplified. 

Example: Cycle step the following program. 



>J0 
>C 



IFADDR ADDRESS DATA 

0000 0000 31 

0001 00 

0002 20 
0003 0003 CD 

0004 00 

0005 01 
IFFF 00 
IFFE 06 

0100 0100 11 

0101 00 

0102 10 
0103 0103 3E 



STATUS SPARE (8 BITS) 



S 
R 
R 
S 
R 
R 
W 
W 
S 
R 
R 
S 



11111111 <CR> 



11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<ESC> 



Example: Cycle step the above program using a count of 3. 



11111111 <CR> 



>J0 










>C2 












IFADDR 


ADDRESS 


DATA < 


5TA' 






0002 


20 


R 






0005 


01 


R 




0100 


0100 


11 


S 




0103 


0103 


3E 


S 






1000 


20 


W 




0108 


0108 


FE 


S 






OlOB 


03 


R 



11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<CR> 


11111111 


<ESC> 



>-3 



8.2 Instruction Step Command - S 
S[S|R][cotint]|Z 



S is the command for Instruction Step. 

S (option) displays messages in mnemonic form. 

R displays register contents in addition to mnemonic code. 

count is an hexadecimal value from OOOOH to FFFFH specifying the step 
interval between status display. (Note that OOOOH indicates 
lOOOOH steps.) 

Z displays cycle status in addition to mnemonic code. 

8.2.1 Instruction Step 

S 



If count is not specified for instruction step, the default is one. In this 
mode, MICE first displays the current Instruction to be executed and waits 
for input. To cause the emulation processor to execute this instruction, a 
<CR> or <LF> should be entered; the new status is then displayed and MICE 
again waits. Enter a <CR> or <LF> to repeat the entire sequence, displaying 
the new status after every instruction. Enter <ESC> to terminate the single 
step mode of emulation. (Remember that breakpoints are not active for the S 
command . ) 

Instruction step only displays "S" status to indicate an instruction fetch 
cycle; no other status types are displayed. If a more careful examination of 
a program is required, first Instruction Step to the problem area, and then 
Cycle Step through the problem area for a more detailed display. 

Example: Instruction step the previous program. Note that the processor does 
not begin emulation until the current status displays and either a 
<CR> or <LF> is entered. 

>J0 
>S 

IFADDR ADDRESS DATA STATUS SPARE (8 BITS) 
0000 0000 31 S 11111111 <CR> 
0003 0003 CD S 11111111 <CR> 
0100 0100 11 S 11111111 <ESC> 
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8.2.2 Instruction Step in Mnemonic Form 
SS 



Example: Instruction step with S option. 
>J0 

>ss 

~ IFADDR ADDRESS DATA SOURCE CODE 

0000 0000 31 LD SP.aOOO <CR> 

0003 0003 CD CALL 0100 <CR> 

0100 0100 11 LD DE.IOOO <ESC> 



8.2.3 Instruction Step with Register Content 
SR 



The R option displays register content along with mnemonic information. All 
register contents associated with the current step in program execution can 
be observed; but remember that the contents displayed are prior to executing 
the instruction. 

Example: Instruction step with R option. 
>J0 

~ IFADDR ADDRESS DATA SOURCE CODE 

A=00 6=00 C=06 D=10 E=01 H=F7 L=FF 1=00 F=9B X=300F Y=FFFF S=1FFE PC=0000 

0000 0000 31 LD SP,2000 <CR> 
A=00 B=00 C=06 D=10 E=01 H=F7 L=FF 1=00 F=9B X=300F Y=FFFF S=2000 PC=0003 

0003 0003 CD CALL 0100 <ESC> 
> 

The SR command for MICE-II Z8 and ZS8 displays working register content for 
the current instruction step in addition to mnemonic code (refer to RW com- 
mand, section 5-8). 
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Example: Execute instruction-step with mnemonic code for MICE-II Z8. 



>SR 





IFADDR ADDRESS DATA 


SOURCE CODE 


















OOOC 


OOOC 


31 


SRP 


#40 
















HP 


1 


2 3 


4 


5 6 


7 8 


9 


A 


B 


C 


D 


F, 


F 


40 


00 00 
OOOE 


00 00 
OOOE 


47 

4c 


00 00 
LD 


00 00 
R04,#AA 


00 


00 


10 


00 


00 


00 


00<CR> 


HP 


1 


2 3 


4 


5 6 


7 8 


9 


A 


B 


c 


D 


R 


F 


4u 


00 00 
0010 


00 00 
0010 


AA 
31 


00 00 
SRP 


GO 00 

#50 


00 


00 


10 


00 


00 


00 


00<CR> 


HP 


1 


2 3 


4 


5 6 


7 8 


9 


A 


B 


c 


D 


F, 


F 


bu 


00 GO 
0012 


00 00 
0012 


AA 
4C 


00 00 
LD 


00 00 
R04.#55 


00 


00 


10 


00 


00 


00 


00<CR> 


RP 


G 1 


2 3 


4 


5 6 


7 8 


9 


A 


B 


c 


D 


F, 


F 


bu 

> 


00 00 


00 00 


55 


00 00 


00 00 


00 


00 


10 


00 


00 


00 


00<ESC> 



Example: Execute instruction-step with mnemonic code for MICE-II ZS8. 



>SR 

IFADDR ADDRESS DATA 
0020 
RP0{C0) RO 
RP1(C8) R8 



FF 



RP0(50) RO 
RP1{58) R8 

RPO{EO) R0= 
RP1(E8) R8= 

RPO(EO) R0= 
RP1(E8) R8= 
> 



0020 

11 R1=AA R2= 

=AA R9=FA RA= 

0021 31 

=55 R1=AA R2= 

=55 R9=8A RA= 

0023 31 

OA Rl=08 R2= 



SOURCE CODE 

NOP 
=A2 R3=55 r4=75 R5: 
=AA RB=55 RC=77 RD= 



SRP 



#50 



=8A R3=15 r4=5D R5= 
^AA RB=55 RC=57 rd= 



SRP 



#E0 



AA R6=AA R7=55 
AE RE=AB RF=75 

AA r6=A9 R7=55 
AA RE=A2 RF=5F 



=00 R3=00 R4=00 R5= 
-- R9=— RA=— RB=02 RC=00 RD= 

0025 FF NOP 
OA Rl=08 R2=00 R3=00 R4=00 R5: 
-- R9=— RA=-- RB=02 RC=00 RD= 



00 R6=- 
00 RE=- 

00 R6=- 
00 RE=- 



R7=- 
RF=00 

R7=- 
RF=00 



CZSVDHFB PC =0021 
00110000 <CR> 

CZSVDHFB PC=0023 
00110000 <CR> 

CZSVDHFB PC=0025 
01010000<CR> 

CZSVDHFB PC=0026 
01010000<ESC> 



8.2.4 Instruction Step with Count 
S[S|R] count 



If an instruction count of one (default) is entered, the current instruction 
to be executed is displayed; MICE-II does not step. If an instruction count 
other than one is entered, emulation immediately begins from the current 
program counter and continues until the count of the next instruction to be 
executed equals the number specified. The current status is then displayed 
and MICE-II waits for a <CR> or <LF> before executing the next "count" 



8-6 



instruction. Enter an <ESC> to terminate the multi-step mode of emulation. 
For large intervals, emulation may be terminated by entering an <ESC> before 
the specified number of instructions are executed. 

Instruction Step executes "count-1" instructions before the first status 
line is displayed and then executes "count" instructions between subsequent 
displays. 

Example: Multi-step the program and compare results with the first example. 



>J0 
>S2 



IFADDR ADDRESS DATA STATUS SPARE {8 BITS) 
0007 0007 CD S 11111111 <CR> 
0103 0103 3E S 11111111 <CR> 
0107 0107 E5 S 11111111 <CR> 
OlOD OlOD El S 11111111 <ESC> 



> 



8.2.5 Instruction Step with Cycle Status 
SZ 



The SZ option includes a memory and I/O access message that provides data 
for bus cycles R/W/I/O/A [e.g. 7FEF-W-12]. The first four digits {7FEF) in- 
dicate the memory address; the capital letter (W) represents the type of 
bus cycle; and the last two digits (12) are the data transferred. 



Example: Instruction step the program displaying Cycle sta±us together 
mnemonic code. 



with 



>J0 












>sz 














IFADDR 


ADDRESS 


DATA 


SOURCE CODE 




0000 


0000 


31 


LD 


SP,2000 <CR> 




0003 


0003 

IFFF 


CD 
-W- 00 


CALL 


0100 <CR> 






IFFE 


-W- 06 


<CR> 






0100 


0100 


11 


LD 


DE.IOOO <CR> 




0103 


0103 


3E 


LD 


A, 20 <ESC> 



8-7 



8.3 Application Notes for Stepped Emulation Commands 



1) To make debugging easier, there are two available methods for slowing 
down the CPU's execution speed. 

a) Use the C command with a "0" count to slow execution speed as follows: 



MICE-II 



Speed 



Z80 

NSC800 
Z8 
ZS8 



1/150 
1/130 
1/708 
1/4^4 



b) Use the S command with a "0" count to slow execution speed as follows: 



MICE-II 



Speed 



Z80 

NSC8Q0 
Z8 
ZS8 



1/7980 
1/6450 
1/710 

1/459 



c) Typing ahead with <CR> will keep the processor running. 

Example: >C^ 

<CR> 
<CR> 
<CR> 
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CHAPTER 9 
UTILITY COMMANDS INVOLVING A SYSTEM 



These commands are only applicable when MICE-II Is connected to a host 
system. Programs and data can be downloaded from a file in a host computer 
to memory in the target system. Conversely, information can also be uploaded 
from the target back to the host. i 

Intel and Tektronix loading formats, both of which are recognized by MICE, 
are described in detail in the following pages . 

Note: For the microcontrollers Z8 and ZS8, Upload and Download commands can 
only access emulation program memory, i.e. memory type "P". (Refer to 
section 2.7 for a detailed description of memory types). 



9-1 Download Command (Intel Format) 
: load- record 



: is the command keyword for Download. 

load-record is a string of ASCII data containing up to 128 bytes of program 
information. 

Each record transferred contains the record type, length, memory load ad- 
dress, and checksum in addition to data. Each transfer is limited to 128 
bytes of program data. The general format of a record, shown with spaces 
separating each field, is: 



ECORD 


RECORD 


LOAD 


MARK 


LENGTH 


ADDRESS 


z 


## 


aaaa 



RECORB I PROGRAM 



TYPE 
tt 



DATA 
dd...dd 



CHECK- 
SUM 
cc 



where : 



: is the keyword used to signal start of record. 

## is a two ASCII hexadecimal value indicating the record length, the 

number of data bytes in the record. 

aaaa is a four ASCII hexadecimal value indicating the program memory 
load-address, the address at which the first byte is to be loaded. 
(For record type 01 [next item], this field contains "0000".) 
Successive data bytes are stored in the following memory locations. 

tt is a two ASCII hexadecimal value representing the record type: 



tt 

00 - data record 

01 - end of file record 



actual data length 
00 



dd — dd is a two ASCII hexadecimal value per byte representation of 
program. 



the 



tt dd...dd 

00 A pair of hex digits representing the ASCII code for each 
data byte, where the high order digit is the 1st digit of 
each pair. 

01 none 
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cc is a two ASCII hexadecimal value representing the negative sum of 
the record. Beginning with the record length "##" and ending with 
the checksum "cc", the hexadecimal sum, taken two at a time, modulo 
256 should be zero. 

When MICE-II receives a ":", it reads the record length (##) . The rest of 
the record is then read and verified. If the incoming checksum agrees with 
the computed checksum, MICE-II stores the data into program memory of the 
target system and reprompts after the following acknowledgement response 
<ACK sequence> is sent: 

ACK LF OR NUL NUL NUL NUL NUL NUL 

If the checksum does not agree, MICE-II also reprompts but the alternate 
negative acknowledgement response <NAK sequence> is sent: 

NAK LF OR NUL NUL NUL NUL NUL NUL 

Example: Download with an end-record into a target system using Intel format. 
Note that the received characters are not echoed. A <CR> is not 
required at the end of the input line. 

> :060000002300A8A9170^6B<ACK sequence> 

> :00000001FF<ACK sequence> 

> 

In the above example, the first load record is 

## = O6H 

aaaa = OOOOH 

tt = OOH 

dd...dd = 23H, OOH, A8H, A9H, I7H, 04H 

cc = 6bh 

where: 06h+OOH+OOH+OOH+23H+OOH+A8H+A9H+17H+04H+6BH = OOH 

For the end-record. 



## 


= OOH 


aaaa 


= OOOOH 


tt 


= OIH 


cc 


= FFH 



where: OOH+OOH+OOH+OIH+FFH = OOH 
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Example: Download with an end- record into a target system using Intel type 2 
format. 

> :1000000000^992DB246DB6FF4891DA263CB5FE47E5<ACK sequence) 

> :0600100090D9226BB4FD43<ACK sequence) 

> :020000020036C6<ACK sequence) 

) :100000000062C42688EA4CAE1072D43698FA5CBEOO<ACK sequence) 

) :080010002082E446A80A6CCE30<ACK sequence) 

> :00000001FF<ACK sequence) 

) 

End-of-record must then be specified by 01 in the last line of transmission. 
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9.2 Download Command (Tektronix Format) - / 
/load-record 



/ 



is the command keyword for Download. 



load-record is a string of ASCII data containing up to 128 bytes of program 
information. 

Each record transferred contains the record type, length, memory load ad- 
dress and checksum in addition to data. Each transfer is limited to 128 
bytes of program data. The general format of a record, shown with spaces 
separating each field, is: 



RECORD 

MARK 

/ 



LOAD 

ADDRESS 

aaaa 



RECORD 

LENGTH 

## 



LOAD 

SUM 

ss 



PROGRAM 

DATA 
dd...dd 



CHECK- 
SUM 
cc 



where: 

/ is the keyword used to signal start of record. 

aaaa is a four ASCII hexadecimal value indicating the program memory 
load-address, the address at which the first byte is to be loaded. 
Successive data bytes are stored in the following memory locations. 

## is a two ASCII hexadecimal value indicating record length, the 
number of data bytes in the record. A record length of zero indi- 
cates end-of-file. 

ss is a two ASCII hexadecimal value representing the sum of the pre- 
ceding six digits, load- address and record length. 

dd...dd is a two ASCII hexadecimal value per byte representation of the 

program . 

cc is a two ASCII hexadecimal value representing the sum of the digits 
comprising the data, modulo 256. 

When MICE-II receives a "/", input is read until a <CR> terminates the line. 
Checksums are then computed and compared. If the incoming checksum agrees 
with the computed checksum, MICE-II stores the data into program memory of 
the target system and reprompts after the following acknowledgement response 
<ACK sequence> is sent: 

ACK LF CR NUL NUL NUL NUL NUL NUL 
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If the checksum does not agree, MICE-II also reprompts but the alternate 
negative acknowledgement response <NAK sequence> is sent: 

NAK LF CR NUL NUL NUL NUL NUL NUL 

Example: Download with an end- record into a target system using Tektronix 
format . 

> /000006062300A8A9170't36<CR> 

<ACK sequence> 

> /00000000<CR> 

<ACK sequence> 

> 

In the above example, the load record is 

aaaa = OOOOH 

## = 06H 

ss = 06h 

dd...dd = 23H, OOH, A8H, A9H, 17H, O'tH 

cc = 36H 

where: ss = 0H+0H+0H+0H+0H+6H = 06H 

cc = 2H+3H+OH+OH+AH+8H+AH+9H+1H+7H+OH+4H = 36H 

For the end-record. 



aaaa 


= OOOOH 


## 


= OOH 


ss 


= OOH 



where: ss = OH+OH+OH+OH+OH+OH = OOH 
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9-3 Upload Command - U 

U start-address end-address [format] 



U is the command for Upload. 

start-address is a logical hexadecimal address of the emulation processor's 
memory where data transfer begins. 

end-address is the last logical hexadecimal address of the emulation pro- 
cessor's program memory where data transfer ends. 

format is a single alphabetic character [liT] indicating the load- 
record format to be used. 

I - Intel 

T - Tektronix 

Memory contents defined by the memory range start-address to end-address are 
transferred to the host system using either Intel or Tektronix format. If 
the format is not specified, then Intel is used. Also, the end-address must 
be greater than or equal to the start-address or an error message is sent 
and the command ended. 

MICE-II first sends the current segment value record to the host system. It 
then reads data from memory and sends a maximum of 32 bytes (depending on 
data length) to the host system using one of the above formats. Data trans- 
mission continues in this manner until an end address is sent. MICE-II then 
sends an end-of -record file and prompts for the next command. 

If anything other than an <ACK> is received when MICE-II is waiting for an 
acknowledgement response, the same block is retransmitted. If after five 
retries transmission is still unsuccessful, the command is aborted, and an 
error message is sent to the host system before MICE-II prompts for the next 
command. The command can also be aborted by the host system when MICE-II 
receives an <ESC> character from the console. 
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Example: Upload from MICE-II using Intel format. Note that load records are 
shown on separate lines for clarity. No <CR> or <LF> characters are 
generated by MICE-II , and anything received other than an <ACK> , is 
treated the same as a <NAK>. 

> U 6 I<CR> 

: O70OOO0O23O0A89170^6e8FF<ACK> 

:00000001FF<ACK> 



> 

Example: Upload using Tektronix format. 

> U 6 T<CR> 

/000007072300A89170^6e848<CR> 

<NAK> 

/000007072300A89170^6e848<CR> 

<ACK> 

/OOOOOOOO 

<ACK> 



In the above example, the host system did not acknowledge the first trans- 
mission when Tektronix format was used. Hence, the first line was retrans- 
mitted until an <ACK> was received. 
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Appendix A 
Summary of MICE-II Commands 



MICE-II UTILITY COMMANDS 

? - Help Command 

! - Attention Command 



MEMORY, PORT AND REGISTER COMMANDS 

M - Memory Display/Examine/Modify/Fill/Search Command 
M[start-address[ end-address[ data-1...8][ S]] 

T - Memory Checksum/Test/Transfer/Compare Command 
T start-address end-address {S|M|address-3[ V]} 

A - Line Assembly command 
A[ start-address] 

Z - Disassembly Command 

Z[start-address[ end-address]] 

I - Port Input Command 

I port[ count[ duration]] 

- Port Output Command 

port data-1 [ ...data-8] 

X - Reset/Initialization Command 
X[ address] 

R - Register Display/Modify Command 
R[ register] 

J - Jump/Branch Command 
J address 
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CONTROL SIGNAL COMMANDS 

D - Disable/Display Control Signal Command 
D[control signal] 

E - Enable/Display Control Signal Command 
E[ control signal] 



EMULATION AND TMCE CONTROL COMMANDS 

G - Go/Execution Command 
G[ address] 

H - Halt/Breakpoint Set Command 

H[0[l|2]|l[address-1[ count[ qualifier]]] 12 [address-2]] 

F - Forward Trace Command 

F[R]trigger-address[ count[ qualifier]] 

B - Backward Trace Command 

B[R]trigger-address[ count[ qualifier]] 

L - List/Display Trace Buffer Command 

L[step[ address-l[ address-2[ qualifier{s) ]]] |S[step] |Z[step] |N] 



STEPPED EMULATION COMMANDS 

C - Single Cycle/Step Command 
C[ count] 

S - Instruction Step Command 
S[S|R][count]|[Z] 



UTILITY COMMANDS INVOLVING A SYSTEM 

: - Download Command (Intel Format) 
: load-record 

/ - Download Command (Tektronix Format) 
/load-record 

U - Upload Command 

U[type ] start-address end-address [I'T] 
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Appendix B 
Hexadecimal-Decimal Conversion 



To find the decimal equivalent of a hexadecimal number, first locate your 
hex number in the correct position (1st through 4th place digit) in the 
following table. Note the decimal equivalent for each hex digit in your 
number and then add up these decimal values. 

To find the hexadecimal equivalent of a decimal number, locate the next 
lower decimal number in the table, write down the hex equivalent and its 
position {1st through 4th place digit). Subtract this decimal number from 
yours, take the difference and continue this process until conversion is 
completed. 



BYTE 






BYTE 




4th place digit 


3rd place 


digit 


2nd place 


digit 


1st place 


digit 


HEX DEC 


HEX 


DEC 


HEX 


DEC 


HEX 


DEC 


1 




















1 1 4096 


1 


256 


1 


16 


1 


1 


1 2 8192 


2 


512 


2 


32 


2 


2 


1 3 12288 


3 


768 


3 


48 


3 


3 


! 4 16384 


4 


1024 


4 


64 


4 


4 


j 5 20480 


5 


1280 


5 


80 


5 


5 


! 6 24576 


6 


1536 


6 


96 


6 


6 


1 7 28672 


7 


1792 


7 


112 


7 


7 


1 8 32768 


8 


2048 


8 


128 


8 


8 


1 9 36864 


9 


2304 


1 9 


144 


9 


9 


1 A 40960 


A 


2560 


1 A 


160 


A 


10 


1 B 45056 


B 


2816 


1 B 


176 


B 


11 


1 c 49152 


c 


3072 


1 c 


192 


1 c 


12 


1 D 53248 


1 D 


3328 


1 D 


208 


1 D 


13 


1 E 57344 


1 E 


3584 


1 E 


224 


i E 


14 


1 F 61444 


1 F 


3840 


1 F 


240 


1 F 


15 
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Appendix C 
ASCII Code Lists and Definitions 



Table C-1 
ASCII Code List 



HEX 


DEC 


CHAR 1 


HEX 


DEC 


CHAR 


00 





NUL 1 


22 


34 


tt 


01 


1 


BOH 1 


23 


35 


# 


02 


2 


STX 1 


24 


36 


$ 


03 


3 


ETX 1 


25 


37 


% 


04 


4 


EOT 1 


26 


38 


& 


05 


5 


ENQ 1 


27 


39 


t 


06 


6 


ACK 1 


28 


40 


{ 


07 


7 


BEL 1 


29 


41 


) 


08 


8 


BS 


2A 


42 


* 


09 


9 


HT 


2B 


43 


+ 


OA 


10 


LF 


2C 


44 


» 


OB 


11 


VT 


2D 


45 


- 


00 


12 


FF 


2E 


46 


. 


OD 


13 


OR 


2F 


47 


/ 


OE 


14 


SO 


30 


48 





OF 


15 


SI 


31 


49 


1 


10 


16 


DLE 


32 


50 


2 


11 


17 


DCl 


33 


51 


3 


12 


18 


DC2 


34 


52 


4 


13 


19 


DC3 


35 


53 


5 


14 


20 


DC4 


36 


54 


6 


15 


21 


NAK 


1 37 


55 


7 


16 


22 


SYN 


1 38 


56 


8 


17 


23 


ETB 


1 39 


57 


9 


18 


24 


CAN 


1 3A 


58 


: 


19 


25 


EM 


1 3B 


59 


J 


lA 


26 


SUB 


1 3C 


60 


< 


IB 


27 


ESC 


1 3D 


61 


= 


IC 


28 


FS 


1 3E 


62 


> 


ID 


29 


GS 


1 3F 


63 


7 


IE 


30 


RS 


1 40 


64 


'% 


IF 


31 


US 


1 41 


65 


A 


20 


32 


SP 


i 42 


66 


B 


21 


33 


t 


1 43 


67 


C 
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Appendix C 
ASCII Code Lists and Definitions 



Table C-1 
ASCII Code List (Cont. 



HEX 


DEC 


CHAR 


HEX 


DEC 


CHAR 


44 


68 


D 


62 


98 


b 


45 


69 


E 


63 


99 


c 


46 


70 


F 


64 


100 


d 


47 


71 


G 


65 


101 


e 


48 


72 


H 


66 


102 


f 


49 


73 


I 


67 


103 


g 


4a 


74 


J 


68 


. 104 


h 


4b 


75 


K 


69 


105 


i 


4c 


76 


L 


6A 


106 


J 


4d 


77 


M 


6B 


107 


k 


4e 


78 


N 


6C 


108 


1 


4f 


79 





6d 


109 


m 


50 


80 


P 


6E 


110 


n 


51 


81 


Q 


6F 


111 


o 


52 


82 


R 


70 


112 


P 


53 


83 


S 


71 


113 


q 


54 


84 


T 


72 


114 


r 


55 


85 


U 


73 


115 


s 


56 


86 


V 


74 


116 


t 


57 


87 


w 


75 


117 


u 


58 


88 


X 


76 


118 


V 


59 


89 


Y 


77 


119 


w 


5A 


90 


Z 


78 


120 


X 


5B 


91 


[ 


79 


121 


y 


5C 


92 


\ 


7A 


122 


z 


5D 


93 


] 


73 


123 


{ 


5E 


94 


" 


7C 


124 


1 

1 


5F 


95 


- 


7D 


125 


} 


60 


96 




7E 


126 


■^ 


61 


97 


a 


7F 


127 


DEL 
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Appendix C 
ASCII Code Lists and Definitions 



Table C-2 
ASCII-Code Definitions 



ABB 



CTRL 



MEANING 



HEX 



NUL 




NULL Character 


00 


SOH 


A 


Start of Heading 


01 


STX 


B 


Start of Text 


02 


ETX 


C 


End of Text 


03 


EOT 


D 


End of Transmission 


Ok 


ENQ 


E 


Enquiry 


05 


ACK 


F 


Acknowledge 


06 


BEL 


G 


Bell 


07 


BS 


H 


Backspace 


08 


HT 


I 


Horizontal Tabulation 


09 


LF 


J 


Line Feed 


OA 


VT 


K 


Vertical Tabulation 


OB 


FF 


L 


Form Feed 


OC 


CR 


M 


Carriage Return 


OD 


SO 


N 


Shift Out 


OE 


SI 





Shift In 


OF 


DLE 


P 


Data Link Escape 


10 


DCl 


Q 


Device Control 1 


11 


DC2 


R 


Device Control 2 


12 


DC3 


S 


Device Control 3 


13 


DC4 


T 


Device Control 4 


m 


NAK 


U 


Negative Acknowledgement 


15 


SYN 


V 


Synchronous Idle 


16 


ETB 


w 


End of Transmission Block 


17 


CAN 


X 


Cancel 


18 


EM 


Y 


End of Medium 


19 


SUB 


Z 


Substitute 


lA 


ESC 




Escape 


IB 


FS 




File Separator 


IC 


GS 




Group Separator 


ID 


RS 




Record Separator 


IE 


US 




Unit Separator 


IF 


SP 




Space 


20 


DEL 




Delete 


7F 
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Appendix D 
Writing a Driver Program 



Driver programs for various computer systems have already been written. 
However, the driver programs available may not run or be suitable for your 
particular host computer. 

The most important consideration in writing a driver program is the availa- 
bility of an RS-232C port. Without it, a driver program has no means of 
communicating with MICE-II. The programming language used to Implement the 
driver program is not important as long as access to the console, the MICE- 
II communication port and the file system is available. 

Eight modules are necessary to establish a communication link between the 
console and MICE-II. 



InitMICE-II - initialize MICE-II 

TestMICE-II - test if MICE-II sent a character 

ReadMICE-II - read a character from MICE-II 

WriteMICE-II - send a character to MICE-II 

InltCons - initialize baud rate and parity of console 

TestCons - test if console has a character 

ReadCons - read a character from console 

WriteCons - send a character to console 

These eight modules are the necessary ingredients in creating a program to 
replace the simple terminal. 

call InitCons 
call InitMICE-II 
do forever 

if TestCons then do 
Char = ReadCons 
call WriteMICE-II (CHAR) 
end 

if TestMICE-II then do 
Char = ReadMICE-II 
call WriteCons (CHAR) 
end 
end 



If the RS-232C handshaking signals are not monitored, the baud rate selec- 
tion for MICE-II must be less than or equal to the console baud rate to 
avoid overrun errors, where MICE-II is sending too fast for the display 
console. Refer to Chapter 2 for configuring MICE-II with the appropriate 
baud rate, parity and interface (DTE or DCE, with or without handshaking) . 

Interface to the file system requires similar but more complicated modules, 
which vary for different computer systems. The general concept is to have 
the program loop intercept the download and upload commands, not retransmit 
them to MICE-II. The program then queries for the file to be transmitted or 
received. The appropriate command must then be created and transmitted to 
MICE-II. 

Remember that the maximum amount of data that can be transferred at one time 
is limited to 128 bytes for download and 32 bytes for upload. The program 
may be required to reformat data to one of the acceptable formats required 
by MICE-II. Finally, to add hardcopy for CRT consoles, an additional write 
to a remote printer can be added by calling the printer output module each 
time a write to MICE-II or a write to the console is performed. 
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Appendix E 
MICE Driver and Symbolic Debxig Software 



The following is a listing of currently available MICE software. 

List of MICE Software Support 



Host Computer | Operating System | Symbolic 1 High-Level i Company 
1 1 Debug 1 Debug ' 


Altos 8000 ! MP/M-80 1 1 1 Microtek 


Apple II/II+/IIe 1 Apple DOS 3-3 1 1 1 Microtek 


DEC VAX-11 750/780 1 VMS 1 1 1 Microtek 


DEC VAX-11 750/780 i VMS 1 Yes 1 | ARSM^ 


DEC MicroVAX | VMS | Yes | | ARSM 


DEC Rainbow | CP/M-86 & MS-DOS | Yes | 1 ARSM 


IBM PC/XT/ AT 1 CP/M-86 & MS-DOS | | i Microtek 


IBM PC/XT/AT 1 MS-DOS 1 Yes | | ARSM 


IBM PC/XT/AT 1 MS-DOS | Yes | Yes | RTCS^ 


Intel-MDS 220/225/286 i ISIS-II/III 1 i ! Microtek 


Intel-MDS 220/225/286 i ISIS-lI/Ill | Yes | 1 ARSM 


Intel-MDS 310/380 | iRMX-86 | Yes | Yes | RTCS 


Intel-PDS 1 ISIS-II | | | Microtek 


Sun Microsystems ] UNIX I Yes | | ARSM 


8O8O/8O85/Z8O systems | CP/M Version 2.2 | Yes | | ARSM 


NEC 9801 1 MS-DOS 1 i i Microtek 




1 1) ARS Microsystems Ltd. | 2) Real-Time Computer Science Corp. | 
1 Doman Road, Camberly | 1390 Flynn Road- | 
! Surrey, GUI5 3DF, England | Camarillo, CA 93010, U.S.A. | 
1 TEL: (0276) 64341 TLX: 858779 1 TEL: (805) 987-9781 TLX: 467897 1 
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Appendix F 
Emulation Memory Boards (UEM/HUEM) 



The Emulation Memory board is the bottom board in the three board MICE-II 
module. Each memory board supports 32K bytes (UEM) or 64/128K bytes (HUEM) 
of emulation memory. 

Memory can be expanded with the addition of HUEM boards. Memory boards can 
be added simply by the addition of six brass spacers for each board and by 
replacing the existing 50 pin flat wire assembly with enough connections to 
join the Control Emulation Processor board, Realtime Trace board and the 
number of memory boards required. An additional board can be assembled into 
the MlCE-lI case by using smaller spacers. However, we recommend leaving the 
cover of the MICE-II case off while using four boards, otherwise overheating 
may cause intermittent problems in operation. 

Remember, each additional memory board requires 800 mA current at +5 volts 
DC which may require a larger power supply to support the expanded memory in 

..^.,« l\flTrit?_TT 
yKJKll. rjJ-Vi-J J--1- . 

A memory expansion package including the HUEM board, spacers and intercon- 
nection cable is optionally available from MICROTEK. 
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Appendix F 

Universal Emulation Memory Board (UEM) 
Placement Chart 
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Appendix F 

Universal Emulation Memory Board (UEM) 
Block Diagram 
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Appendix F 

High Performance Universal Emulation Memory Board (HUEM) 

Placement Chart 
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Appendix F 

High Performance Universal Emulation Memory Board (HUEM) 

Block Diagram 
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Appendix G 



Realtime Trace Board (RTT) 
Placement Chart 
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Appendix G 

Realtime Trace Board (RTT) 
Block Diagram 
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Appendix H 

Control Emulation Processor Board (CEP) 
Block Diagram 
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Appendix I 
Z80 



I . 1 Hardware 

I. 1.1 Control Emulation Processor Board, CEP-Z80 
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1.2 Application Notes for the Z80 Command Set 

1) If a trace or breakpoint is set to stop at a memory write cycle, MICE-II 
Z80 will stop at the next cycle. 

2) For Z80 peripheral chips which use the RETI instruction to reset inter- 
rupt requests or internal flags, the instruction must reside in target 
system memory (not in emulation memory) . 

3) When executing a RETI instruction (whose opcodes are ED and 4D) while in 
BUSAK mode, the peripheral does not allow the CPU to stop in the middle 
of these two bytes (ED and 4d) . 



1.3 Assembly Mnemonic Code Summary, with Disassembly Examples 



LOC 


OBJ 


LINE LABEL SOURCE CODE 


0000 


ED5A 


0001 SOOOO ADC 


HL,DE 


0002 


CEOO 


0002 


ADC 


A, 00 


0004 


87 


0003 


ADD 


A, A 


0005 


C600 


0004 


ADD 


A, 00 


0007 


86 


0005 


ADD 


A,(HL) 


0008 


DD8600 


0006 


ADD 


A,(IX+00) 


OOOB 


FD8600 


0007 


ADD 


A,(IY+00) 


OOOE 


19 


0008 


ADD 


HL.DE 


OOOF 


DDI9 


0009 


ADD 


IX, DE 


0011 


FDI9 


0010 


ADD 


IY,DE 


0013 


E600 


0011 


AND 


00 


0015 


cb4b 


0012 


BIT 


1,E 


0017 


cb4e 


0013 


BIT 


l.(HL} 


0019 


DDCB004E 


0014 


BIT 


l,(IX+00) 


OOID 


FDCB094E 


0015 


BIT 


l,(IY+09) 


0021 


CDOOOO 


0016 


CALL 


0000 


0024 


E40000 


0017 


CALL 


P0,0000 


0027 


3F 


0018 


CCF 




0028 


FEOO 


0019 


CP 


00 


002A 


EDA9 


0020 


CPD 




002C 


EDB9 


0021 


CPDR 




002E 


EDAl 


0022 


CPI 




0030 


EDBl 


0023 


CPIR 




0032 


2F 


0024 


CPL 




0033 


27 


0025 BOO33 DAA 




0034 


IB 


0026 


DEC 


DE 


0035 


DD2B 


0027 


DEC 


IX 


0037 


FD2B 


0028 


DEC 


lY 


0039 


05 


0029 


DEC 


B 


OO^A 


F^ 


0030 


DI 
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LOC 


OBJ 


003B 


10C3 


003D 


FB 


003E 


EB 


003F 


08 


oo4o 


E3 


00^1 


DDE3 


0043 


FDE3 


00^5 


D9 


0046 


76 


0047 


ED46 


0049 


ED56 


004b 


ED5E 


004d 


DBAO 


004f 


ED78 


0051 


3C 


0052 


34 


0053 


DD3409 


0056 


FD3407 


0059 


14 


005A 


DD23 


005c 


FD23 


005E 


EDAA 


0060 


EDBA 


0062 


EDA2 


0064 


EDB2 


0066 


E9 


0067 


DDE9 


0069 


FDE9 


006B 


C3OOOO 


006E 


FAOOOO 


0071 


188D 


0073 


388b 


0075 


3OFF 


0077 


28BA 


0079 


20FC 


007B 


51 


007c 


1699 


007E 


66 


007F 


DD4E07 


0082 


FD56O6 


0085 


210D00 


0088 


DD77O7 


008B 


FD7IO6 


008E 


3602 


0090 


DD360643 


0094 


FD360677 



LINE 
0031 
0032 
0033 
0034 

0035 
0036 

0037 
0038 

0039 
0040 
004 1 
0042 
0043 
0044 
0045 
0046 
0047 
0048 
0049 
0050 
0051 
0052 

0053 
0054 

0055 
0056 

0057 
0058 

0059 
0060 
0061 
0062 
0063 
0064 
OO65 
0066 
0067 
0068 
0069 
0070 
0071 
0072 
0073 
0074 

0075 
0076 



LABEL 



BOO77 



DE.HL 

AF.AF' 

(SP),HL 

(SP),IX 

(SP),IY 





1 

2 

A,{AO) 

A.(C) 

A 

(HL) 

(IX+09) 

(IY+07) 

D 

IX 

lY 



SOURCE CODE 

DJNZ 0000 

EI 

EX 

EX 

EX 

EX 

EX 

EXX 

HALT 

IM 

IM 

IM 

IN 

IN 

INC 

INC 

INC 

INC 

INC 

INC 

INC 

IND 

INDR 

INI 

INIR 

JP 

JP 

JP 

JP 

JP 

JR 

JR 

JR 

JR 

JR 

LD 

LD 

LD 

LD 

LD 

LD 

LD 

LD 

LD 

LD 

LD 



(HL) 

(IX) 

(lY) 

0000 

M.OOOO 

0000 

C.OOOO 

NC,0076 

z,0033 

NZ,0077 
D,C 

D,99 

H,(HL) 

C,(IX+07) 

D,(IY+06) 

HL.OOOD 

(IX+07).A 

{IY+06).C 

(HL),02 

(IX+06),43 

(IY+06),77 
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LOG 


OBJ 


T.TNE 


0098 


OA 


0077 


0099 


lA 


0078 


009A 


3A65OO 


0079 


009D 


02 


0080 


009E 


12 


0081 


009F 


326600 


0082 


00A2 


ED57 


0083 


00A4 


ED5F 


0084 


00A6 


ED47 


0085 


00A8 


ED4f 


0086 


OOAA 


118800 


0087 


OOAD 


DD218800 


0088 


OOBl 


FD2li|'i00 


0089 


00B5 


2A4400 


0090 


00B8 


ED4Bi+400 


0091 


OOBC 


DD2A7600 


0092 


COCO 


FD2A7500 


0093 


00C4 


227600 


0094 


00C7 


ED535400 


0095 


OOCB 


DD224400 


0096 


OOCF 


FD226600 


0097 


00D3 


F9 


0098 


00D4' 


DDF9 


0099 


00D6 


FDF9 


0100 


00D8 


EDA8 


0101 


OODA 


EDB8 


0102 


OODC 


EDAO 


0103 


OODE 


EDBO 


0104 


OOEO 


ED44 


0105 


00E2 


00 


0106 


00E3 


B7 


0107 


00E4 


EDBB 


0108 


00E6 


EDB3 


0109 


00E8 


D307 


Olio 


OOEA 


ED79 


0111 


OOEC 


EDAB 


0112 


OOEE 


EDA3 


0113 


OOFO 


Dl 


0114 


OOFl 


DDEl 


0115 


00F3 


FDEl 


0116 


00F5 


B5 


0117 


00F6 


DDE5 


0118 


OOFS 


FDE5 


0119 


OOFA 


CB8F 


0120 


OOFC 


C9 


0121 


OOFD 


F8 


0122 



LABEL 



SOURCE CODE 


LD 


A,{BC) 


LD 


A,(DE) 


LD 


A. (0065) 


LD 


(BC),A 


LD 


{DE),A 


LD 


(0066). A 


LD 


A, I 


LD 


A.R 


LD 


I. A 


LD 


R,A 


LD 


DE,0088 


LD 


IX, 0088 


LD 


IY,0044 


LD 


HL,(0044) 


LD 


BC,(0044) 


LD 


IX, {0076) 


LD 


IY,(0075) 


LD 


(0076), HL 


LD 


(0054),DE 


LD 


(0044), IX 


LD 


(0066),IY 


LD 


SP.HL 


LD 


SP.IX 


LD 


SP.IY 


LDD 




LDDR 




LDI 




LDIR 




NEG 




NOP 




OR 
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OTDR 




OTIR 




OUT 


(07). A 


OUT 


(C).A 


OUTD 
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POP 


DE 


POP 


IX 


POP 


lY 


PUSH 


DE 


PUSH 


IX 


PUSH 


lY 


RES 
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RET 




RET 
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I-c; 



LOC 


OBJ 


LINE 
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ed4d 


0123 


0100 


ed45 


0124 


0102 


CB17 


0125 


OlO^t 


17 


0126 


0105 


CBOl 


0127 


0107 


CB06 


0128 


0109 


DDCB0706 


0129 


OlOD 


FDCB0706 


0130 


0111 


07 


0131 


0112 


ed6f 


0132 


0114 


CBIF 


0133 


0116 


IF 


0134 


0117 


CBOA 


0135 


0119 


OF 


0136 


OllA 


ED67 


0137 


one 


C7 


0138 


OllD 


98 


0139 


OllE 


ED52 


0140 


0120 


37 


0141 


0121 


CBCF 


0142 


0123 


CBCE 


0143 


0125 


DDCB07CE 


0144 


0129 


FDCB67CE 


0145 


012D 


CB20 


0146 


012F 


CB2B 


0147 


0131 


CB3A 


0148 


0133 


90 


0149 


0134 


AF 


0150 



LABEL 



SOURC 

RETI 


E CODE 


RETN 
RL 


A 


RLA 




RLC 


C 


RLC 


(HL) 


RLC 


{IX+07) 


RLC 


(IY+07) 


RLCA 




RLD 




RR 


A 


RRA 




RRC 


D 


RRCA 




RRD 




RST 


00 


SBC 


A,B 


SBC 


HL.DE 


SCF 




SET 


l.A 


SET 


1.{HL) 


SET 


l,(IX+07 


SET 


l.(IY+67 


SLA 


B 


SRA 


E 


SRL 


D 


SUB 


B 


XOR 


A 
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Appendix J 
NSC800 



J . 1 Hardware 

J. 1.1 Control Emulation Processor Board, CEP-NSC8OO 
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J. 2 Application Notes for NSC800 Command Set 

1) During I/O read and write cycles, the I/O port address is duplicated in 
the upper byte of the address. If port addresses are used as halt or 
trace addresses, the command specification must also duplicate the port 
address in the upper byte. 

2) Dynamic memory refresh from the NSCSOO is not supported by MICE-II 
NSC800 during Cycle Step or Instruction Step operation. 



J. 3 Assembly Mnemonic Code Svimmary, with Disassembly Examples 

Refer to section 1.3. 



J -3 



Appendix K 
Z8 



K . 1 Hardware 

MICE-II Z8 comes with two or three boards, depending on the user's specified 
emulation requirements. When only internal memory is used, the CEP-Z8 and 
RTT boards are all that is required. However, when external memory is used, 
UEM or HUEM is also required. When replacing the CEP board on another MICE 
model with the CEP-ZB, UEM/HUEM may be removed if desired. 

1) The CEP-Z8 uses a Z86l2 to emulate Z86ll , Z86l3 and Z868l processors. 

2) Z8601, Z8603, Z867I and Z8682 processors can also be emulated; but exter- 
nal program memory (2K-4K bytes) must be transferred to the CEP-Z8 RAM at 
U51(6264). Either read the data into the host computer and then download 
it to MICE emulation memory, or place the target ROM on the CEP-ZS at 
U5I. However, note that data memory {2K-4K bytes) cannot be accessed by 
the user program. 
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K.1.1 Control Emulation Processor Board, CEP-Z8 
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K.2 Application Notes for the Z8 Command Set 

1) The Z8 family has no HALT or READY state. When the emulatplon CPU is 
stopped by any MICE command, it will execute a "JR $" instruction to 
prevent the program counter from changing to another location. 

2) If execution is halted by H3/H4 at a one-byte instruction at the last 
cycle of a multi-byte instruction, the program counter will equal the 
halt address plus two instructions. For any other break location, the 
program counter will equal the halt address plus one instruction. If any 
other breakpoint is encountered, or the program is cycle-stepped or in- 
struction-stepped, the program counter will point to next instruction. 

3) When port 1 is set at high impedance mode (i.e. D3 & D4 = 1 in RF8 [RF8 
= XXXllXXX]), MICE control program will overwrite one register during 
A/I/J/M/O/R/SR/T/Z, Upload and Download commands. The user should define 
any general purpose register r4~R7F to be overwritten, otherwise default 
is for R4. 

Example: If RF8(P01M) = 9EH, then RW will display as indicated below. 

>RW 

*** HIGH- IMPEDANCE AD0-AD7,AS~ ,DS~ ,R/W~! 

*** OVERWRITE WHICH REGISTER {04H~7FH, <CR>=04H)? ^F 

RP OI23456789ABCDEF 

20 OA 31 OC E3 00 BF 46 23 23 23 23 78 DA OE 23 23 

> 

4) If PC(H/L) and FLAGS are saved at R04h-R06H on the stack, and an internal 
interrupt is accepted during A/I/J/M/O/R/SR/T/Z, Upload or Download com- 
mand execution, the PC and FLAGS will be overwritten. 

5) If PO/Pl are both set to I/O mode, and RO^tnOH, and the register pointer 
(RP) is within an unused range {i.e. 8OH-EOH) , the contents of RFEH and 
RFFH will be overwritten during A/I/J/M/O/R/SR/T/Z, Upload or Download 
command execution. 



K-4 



K.3 Z8 Assembly Mnemonic Code Summary, with Disassembly Examples 



LOG 


OBJ 


LINE LABEL SOURCE CODE 


0004 


140100 


0003 


ADC 


00,01 


0007 


-1 Ji r\'jT^}i 


0004 


ADC 




OOOA 


14E503 


0005 


ADC 


03,R05 


OOOD 


150604 


0006 


ADC 


04.@06 


0010 


I507E6 


0007 


ADC 


R06,@07 


0013 


15E708 


0008 


ADC 


08,@R07 


0016 


160901 


0009 


ADC 


09. #01 


0019 


16E823 


0010 


ADC 


R08,#23 


OOIC 


170A45 


0011 


ADC 


@OA,#45 


OOIF 


17E967 


0012 


ADC 


@R09,#67 


0022 


02AB 


0013 


ADD 


ROA.ROB 


0024 


03CD 


0014 


ADD 


ROC.@ROD 


0026 


040C0B 


0015 


ADD 


OB.OC 


0029 


040DEE 


0016 


ADD 


ROE.OD 


002C 


04EF0E 


0017 


ADD 


OE.ROF 


002F 


O5IOOF 


0018 


ADD 


0F,@10 


0032 


O5IIEO 


0019 


ADD 


R00,@11 


0035 


05E112 


0020 


ADD 


12,@R01 


0038 


061389 


0021 


ADD 


13, #89 


003B 


06E2AB 


0022 


ADD 


R02,#AB 


003E 


0714CD 


0023 


ADD 


@14,#CD 


0041 


07E3EF 


0024 


ADD 


@R03,#EF 


0044 


5245 


0025 


AND 


R04,R05 


0046 


5367 


0026 


AND 


R06,@R07 


0048 


541615 


0027 


AND 


15,16 


004b 


5417E8 


0028 


AND 


R08,17 


004e 


54E918 


0029 


AND 


18,R09 


0051 


55IAI9 


0030 


AND 


19,@1A 


0054 


55IBEA 


0031 


AND 


R0A,@1B 


0057 


55EB1C 


0032 


AND 


1C,@R0B 


005A 


561D41 


0033 


AND 


ID, #41 


005D 


56EC42 


0034 


AND 


ROC , #42 


0060 


571E43 


0035 


AND 


@1E.#43 


0063 


57ED44 


0036 


AND 


@R0D,#44 


0066 


D60012 


0037 


CALL 


$0012 


0069 


d420 


0038 


CALL 


@20 


006B 


d4ee 


0039 


CALL 


@RROE 


006D 


EF 


0040 


CCF 




OO6E 


B021 


0041 


CLR 


21 


0070 


BOEF 


0042 


CLR 


ROF 


0072 


B122 


0043 


CLR 


@22 


0074 


BlEO 


0044 


CLR 


@R00 


0076 


6023 


0045 


COM 


23 


0078 


60E1 


0046 BOO78 COM 


ROl 



LOG 


OBJ 


LINE LABEL SOURCE CODE 


007A 


6124 


0047 


COM 


@24 


007c 


61E2 


0048 


COM 


@R02 


007E 


A234 


0049 


CP 


R03,R04 


0080 


A356 


0050 


CP 


R05,@R06 


0082 


A42625 


0051 


CP 


25,26 


0085 


A427E7 


0052 


CP 


RO7.27 


0088 


A4E828 


0053 


CP 


28.RO8 


OO8B 


A52A29 


0054 


CP 


29,@2A 


008E 


A52BE9 


0055 


CP 


R09,@2B 


0091 


A5EA2C 


0056 


CP 


2C,@R0A 


oog'i 


A62DFE 


0057 


CP 


2D,#FE 


0097 


A6EBDC 


0058 


CP 


ROB.#DC 


009A 


A72EBA 


0059 B009A CP 


@2E,#BA 


009D 


A7EC98 


GG6O 


CP 


@R0C,#98 


OOAO 


402F 


0061 


DA 


2F 


00A2 


40ED 


0062 


DA 


ROD 


00A4 


4130 


0063 


DA 


@30 


00A6 


41EE 


0064 


DA 


§ROE 


00A8 


0031 


GO65 


DEC 


31 


OQAA 


OGEE 


0066 BOOAA DEC 


ROE 


OOAC 


0132 


GO67 


DEC 


@32 


OOAE 


OlEF 


0068 


DEC 


@ROF 


GOBO 


8032 


0069 


DECW 


32 


00B2 


8OEO 


0070 


DECW 


RROO 


00B4 


8133 


0071 


DECW 


@33 


00B6 


8IEI 


0072 


DECW 


@R01 


00B8 


8F 


0073 


DI 




00B9 


2A7F 


0074 


DJNZ 


R02,$013A 


COBB 


3A80 


0075 


DJNZ 


R03.$003D 


OOBD 


9F 


0076 


EI 




OOBE 


4e 


0077 


INC 


R04 


OOBF 


2034 


0078 


INC 


34 


OOCl 


2135 


0079 


INC 


635 


00C3 


21E5 


0080 


INC 


@R05 


00C5 


A036 


0081 


INCW 


36 


00C7 


A0E6 


0082 


INCW 


RR06 


00C9 


AI37 


0083 


INCW 


@37 


OOCB 


A1E7 


0084 


INCW 


@R07 


OOCD 


BF 


0085 


IRET 




OOCE 


ODOO34 


0086 


JP 


F.$0034 


OODl 


IDOG56 


0087 


JP 


LT,$0056 


00D4 


2D0078 


0088 


JP 


LE,$0078 


00D7 


3D009A 


0089 


JP 


ULE,$009A 


OODA 


4D0GBC 


0090 


JP 


0V,$00BC 


OODD 


5D00DE 


0091 


JP 


MI , $00DE 


OOEO 


6D00F0 


0092 


JP 


EQ,$00F0 
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LOG 


OBJ 


LINE LABEL SOURCE CODE 


00E3 


7D0100 


0093 


JP 


ULT,$0100 


00E6 


8D0200 


0094 


JP 


$0200 


00E9 


9DO3OO 


0095 


JP 


GE.$0300 


OOEC 


AD0400 


0096 


JP 


GT,S0400 


OOEF 


BDO5OO 


0097 


JP 


UGT,$0500 


00F2 


CD0600 


0098 


JP 


NOV, $0600 


00F5 


DDO7OO 


0099 


JP 


PL, $0700 


OOFS 


ED0800 


0100 


JP 


NE,$0800 


OOFB 


FDO9OO 


0101 


JP 


UGE,$0900 


OOFE 


OBCA 


0102 


JR 


F,$00CA 


0100 


1BA8 


0103 BOlOO JR 


LT,$00AA 


0102 


2B86 


0104 


JR 


LE,$008A 


0104 


3B32 


0105 


JR 


ULE,$0138 


0106 


4B33 


0106 


JR 


0V,$013B 


0108 


5B3E 


0107 


JR 


MI, $0148 


OlOA 


6b4e 


0108 


JR 


EQ,$015A 


OlOC 


7B6E 


0109 


JR 


ULT,$017C 


OlOE 


8B7E 


Olio 


JR 


$018E 


0110 


9B77 


0111 


JR 


GE,$0189 


0112 


AB71 


0112 


JR 


GT,$0185 


0114 


BB63 


0113 


JR 


UGT,$0179 


0116 


CB55 


0114 


JR 


N0V,$016D 


0118 


DB42 


0115 


JR 


PL, $0150 


OllA 


EB37 


0116 


JR 


NE,$0153 


one 


FB36 


0117 


JR 


UGE,$0154 


01 IE 


8C44 


0118 


LD 


R08,#44 


0120 


9839 


0119 


LD 


RO9.39 


0122 


A8EB 


0120 


LD 


ROA.ROB 


0124 


B93A 


0121 


LD 


3A,R0B 


0126 


E3CD 


0122 


LD 


ROCOROD 


0128 


F3EF 


0123 


LD 


@ROE,ROF 


012A 


E4603B 


0124 


LD 


3B.60 


012D 


E53E3C 


0125 


LD 


3C.@3E 


0130 


E53FEO 


0126 


LD 


R00,@3F 


0133 


E5E140 


0127 


LD 


40,@R01 


0136 


E64245 


0128 


LD 


42, #45 


0139 


2C46 


0129 


LD 


R02,#46 


01 3B 


E74300 


0130 B013B LD 


@43,#00 


013E 


E7E301 


0131 


LD 


@R03,#01 


0141 


F54544 


0132 


LD 


@44,45 


0144 


F546E4 


0133 


LD 


@R04,46 


014? 


F5E547 


0134 


LD 


@47,R05 


oi4a 


C76748 


0135 


LD 


R06,48(R07) 


014D 


C78AE9 


0136 


LD 


R08,R09(ROA) 


0150 


D7CB49 


0137 


LD 


49 (ROB) .ROC 


0153 


D7FEED 


0138 BOI53 LD 


R0D(ROE),R0F 
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LOG 


OBJ 


T.TNE LABEL SOURCE CODE 


0156 


C202 


0139 


LDC 


R00,@RR02 


0158 


D254 


0140 


LDC 


@RR04,R05 


OI5A 


C368 


0141 BOI5A LDCI 


@R06,@RR08 


015c 


D3BA 


0142 BOI5C LDCI 


@RROA,@R0B 


OI5E 


82CE 


0143 


LDE 


R0C,@RR0E 


0160 


9210 


0144 


LDE 


@RR00,R01 


0162 


8324 


0145 


LDEI 


@R02,@RR04 


0164 


9356 


0146 


LDEI 


@RR06,@R05 


0166 


FF 


0147 


NOP 




0167 


4278 


0148 


OR 


R07,R08 


0169 


439A 


0149 


OR 


R09,@R0A 


016b 


444b4a 


0150 


OR 


4a,4b 


016E 


444CEB 


0151 


OR 


R0B,4C 


0171 


44ec4d 


0152 


OR 


4d,roc 


0174 


454f4e 


0153 


OR 


4e,@4f 


0177 


455OED 


0154 


OR 


R0D,@50 


017A 


45EE51 


0155 


OR 


51,@R0E 


017D 


465202 


0156 


OR 


52. #02 


0180 


46EF03 


0157 


OR 


R0F,#03 


0183 


475304 


0158 


OR 


@53.#04 


0186 


47EOO5 


0159 


OR 


@R00,#05 


0189 


5054 


0160 BOI89 POP 


54 


OI8B 


5OEI 


0161 


POP 


ROl 


OI8D 


5155 


0162 


POP 


@55 


018F 


51E2 


0163 


POP 


@R02 


0191 


7056 


0164 


PUSH 


56 


0193 


70E2 


0165 


PUSH 


R02 


0195 


7157 


0166 


PUSH 


@57 


0197 


71E3 


0167 


PUSH 


(aR03 


0199 


CF 


0168 


RCF 




019A 


AF 


0169 


RET 




019B 


9058 


0170 


RL 


58 


019D 


90E4 


0171 


RL 


R04 


OI9F 


9159 


0172 


RL 


@59 


OlAl 


91E5 


0173 


RL 


@R05 


01A3 


105A 


0174 


RLC 


5A 


01A5 


10E6 


0175 


RLC 


RO6 


01A7 


II5B 


0176 


RLC 


@5B 


01A9 


11E7 


0177 


RLC 


@R07 


OlAB 


E05C 


0178 


RR 


5C 


OlAD 


E0E8 


0179 


RR 


RO8 


OlAF 


EI5D 


0180 


RR 


@5D 


OlBl 


E1E8 


0181 


RR 


@R08 


01B3 


CO5E 


0182 


RRC 


5E 


01B5 


C0E9 


0183 


RRC 


R09 


01B7 


CI5F 


0184 


RRC 


@5F 
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LOG 


OBJ 


01B9 


ClEA 


OIBB 


32BC 


OIBD 


33DE 


OIBF 


346160 


01C2 


34FFEF 


01C5 


34E062 


01C8 


356463 


OICB 


3565E1 


OICE 


35E266 


OlDl 


366706 


01D4 


36E307 


01D7 


3768O8 


OlDA 


37E409 


OIDD 


DF 


OlDE 


DO69 


OlEO 


D0E5 


01E2 


DI6A 


01E4 


D1E6 


01E6 


3IOA 


01E8 


2278 


OlEA 


239A 


OlEC 


246C6B 


OlEF 


246DEB 


01F2 


24EC6E 


01F5 


257O6F 


01F8 


257IED 


OlFB 


25EE72 


OlFE 


2673OB 


0201 


26EFOC 


0204 


2774OD 


0207 


27EOOE 


020A 


FO75 


020C 


FOEl 


020E 


FI76 


0210 


F1E2 


0212 


6234 


0214 


6356 


0216 


647877 


0219 


6479E7 


021C 


64E87A 


021F 


Cziinnxi 


\jj 1%^ lu 


0222 


657DE9 


0225 


65EA7E 


0228 


667FOF 


022B 


66EB10 


022E 


67F020 



LINE 
0185 
0186 
0187 
0188 
0189 
0190 
0191 
0192 
0193 
0194 
0195 
0196 
0197 
0198 

0199 

0200 

0201 

0202 

0203 

0204 

0205 

0206 

0207 

0208 

0209 

0210 

0211 

0212 

0213 

0214 

0215 

0216 

0217 

0218 

0219 

0220 

0221 

0222 

0223 

0224 

0225 

0226 

0227 

0228 

0229 



LABEL 



SOURCE CODE 



RRC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SBC 

SCF 

SRA 

SRA 

SRA 

SRA 

SRP 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SUB 

SWAP 

SWAP 

SWAP 

SWAP 

TCM 

TCM 

TCM 

TCM 

TCM 

TCM 

TCM 

TCM 

TCM 

TCM 

THM 



@ROA 

ROB, ROC 

ROD,@ROE 

60,61 

ROF.FF 

62,R00 

63,@64 

R01,@65 

66.@R02 

67, #06 

R03,#07 

@68,#08 

@R04.#09 

69 

RO5 
@6a 
@R06 

#0A 

R07,R08 

R09,@R0A 

6B,6C 

R0B,6D 

6E,R0C 

6f,@70 

R0D,@71 
72 , (§ROE 
73.#OB 
ROF,#OC 

@ROO,#OE 

75 

ROl 

@76 

@R02 

R03,R04 

R05,@R06 

77.78 

R07,79 

7A,R08 

7B,§7C 

R09.@7D 

7E.@R0A 

7F,#0F 

ROB, #10 

OFO - #20 
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LOC 


OBJ 


LINE LABEL SOURCE CODE 


0231 


67EC30 


0231 


TCM 


@R0C.#30 


0234 


72DE 


0232 


TM 


ROD, ROE 


0236 


73FO 


0233 


TM 


R0F,@R00 


0238 


74F2F1 


0234 


TM 


F1,F2 


O23B 


74F3E1 


0235 


TM 


R01,F3 


023E 


74e2f4 


0236 


TM 


F4,R02 


0241 


74FEE3 


0237 


TM 


RO3.FE 


0244 


74e4F5 


0238 


TM 


F5.R04 


0247 


75F7F6 


0239 


TM 


F6,@F7 


024a 


75F8E5 


0240 


TM 


R05.@F8 


024D 


75E6F9 


0241 


TM 


F9,@R06 


0250 


76FA40 


0242 


TM 


FA, #40 


0253 


76E750 


0243 


TM 


RO7 , #50 


0256 


77FB60 


0244 


TM 


@FB,#60 


0259 


77E870 


0245 


TM 


@R08,#70 


025c 


B29A 


0246 


XOR 


R09,R0A 


025E 


B3BC 


0247 


XOR 


ROB.gROC 


0260 


B40100 


0248 


XOR 


00,01 


0263 


B402ED 


0249 


XOR 


ROD, 02 


0266 


B4EE03 


0250 


XOR 


03, ROE 


0269 


B5O504 


0251 


XOR 


04,@05 


026C 


B506EF 


0252 


XOR 


R0F,@06 


026F 


B5E007 


0253 


XOR 


07.@R00 


0272 


B6O88O 


0254 


XOR 


08, #80 


0275 


B6EI9O 


0255 


XOR 


R01,#90 


0278 


B709AO 


0256 


XOR 


@09.#A0 


027B 


B7E2B0 


0257 


XOR 


@R02,#B0 
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Appendix L 
ZS8 



L.l Hardware 

MICE-II ZS8 comes with two or three boards, depending on the user's speci- 
fied emulation requirements. When only internal memory is used, the CEP-ZS8 
and RTT boards are all that is required. However, when external memory is 
used, HUEM is also required. When replacing the CEP board on another MICE 
model with the CEP-ZS8, UEM/HUEM may be removed if desired. 

The CEP-ZSB uses a Z8883 to emulate the following processors: 



Z8800 


z88ll 


Z8820 


Z8823 


Z8832 


Z8801 


Z8812 


Z8821 


Z883O 


Z8833 


Z8810 


Z8813 


Z8822 


Z8831 





L.1.1 Control Emulation Processor Board, CEP-ZS8 



XIOE^^" Qock Source Jumpe: 
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RS232C 
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UI3 



External Trace 
Spare Bit 



ICE Cable 
Connectors 



I.-1 






7 -It.? 


2 4S 


1 


fll 


£1 


3 1 


fl2 


B2 




A3 


B3 




A-4 


B4 




AE 


BE 




A6 


Be 




nT 


E7 


.J_.. 


Ae 


se 


-L5.- 







EMULftTIOH 
PROCESSOR 

( U12 ON 

CEP 20893) 



1 
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TITLE 

INTERFftCE DinGRftM (ZS9— IG) 
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L.2 Application Notes for the ZS8 Command Set 

1) The ZS8 family has no HALT or READY state. When the emulation CPU is 
stopped by any MICE command, it will execute a "JR $" instruction to 
prevent the program counter from changing to another location. 

2) If execution is halted by H3/H4 at a one-byte instruction at the last 
cycle of a multi-byte instruction, the program counter will equal the 
halt address plus two instructions. For any other break location, the 
program counter will equal the halt address plus one instruction. If any 
other breakpoint is encountered, or the program is cycle-stepped or in- 
struction-stepped, the program counter will point to next instruction. 



L.3 ZS8 Assembly Mnemonic Code Summary, with Disassembly Examples 



LOC 


OBJ 


LINE 


LABEL 


SOURCE 


CODE 


0020 


1201 


0001 




ADC 


R00,R01 


0022 


1323 


0002 




ADC 


R02 , (3R03 


0024 


1403C5 


0003 




ADC 


R05,03 


0027 


1507C6 


0004 




ADC 


R06,@07 


002A 


16C7FF 


0005 




ADC 


RO7 , #FF 


002D 


03AB 


0006 




ADD 


ROA,@ROB 


002F 


04CD0C 


0007 




ADD 


OCROD 


0032 


O5OEOD 


0008 




ADD 


OD,@OE 


0035 


061012 


0009 




ADD 


10, #12 


0038 


0201 


0010 




ADD 


R00,R01 


003A 


0323 


0011 




ADD 


R02,@R03 


003c 


04C514 


0012 




ADD 


14,R05 


003F 


051716 


0013 




ADD 


16,@17 


0042 


O61912 


0014 




ADD 


19, #12 


0045 


6780IA 


0015 




BAND 


R08,1A,#0 


0048 


678209 


0016 




BAND 


R08,R09,#1 


004b 


67C7CB 


0017 




BAND 


ROB, #3, ROC 


004E 


17D8IC 


0018 




BCP 


R0D,1C,#4 


0051 


17EACF 


0019 




BCP 


R0E,R0F,#5 


0054 


570c 


0020 




BITC 


R00,#6 


0056 


77IE 


0021 




BITR 


R01,#7 


0058 


7721 


0022 




BITS 


R02,#0 


OO5A 


0732ID 


0023 




BOR 


R03,1D,#1 


OO5D 


0744C5 


0024 




BOR 


R04,R05,#2 


0060 


0767IE 


0025 




BOR 


1E,#3,R06 


0063 


0789C7 


0026 




BOR 


R07,#4,R08 


0066 


379AFD 


0027 


B0066 


BTJRF 


$0066, R09, #5 


•0069 


37ADOO 


0028 




BTJRT 


$006C,ROA,#6 


006C 


27BEIF 


0029 


B006C 


BXOR 


ROB, IF, #7 


OOdF 


27COCD 


0030 




BXOR 


ROC, ROD, #0 



T -^ 



LOG 


OBJ 


LINE LABEL SOURCE 


: CODE 


0072 


27E320 


0031 


BXOR 


20, #1, ROE 


0075 


2705CF 


0032 


BXOR 


R0F,#2,R00 


0078 


F6OOOO 


0033 


CALL 


$0000 


007B 


F422 


0034 


CALL 


@22 


OO7D 


d44o 


0035 


CALL 


#$40 


007F 


EF 


0036 


CCF 




0080 


BOCl 


0037 


CLR 


ROl 


0082 


6025 


0038 


COM 


25 


008^1 


60C2 


0039 


COM 


R02 


0086 


6126 


0040 


COM 


@26 


0088 


A234 


0041 


CP 


R03.R04 


008a 


A356 


0042 


CP 


R05,@R06 


008c 


A42827 


0043 


CP 


27.28 


008F 


A4C82A 


0044 


CP 


2A.R08 


0092 


A52C2B 


0045 


CP 


2B,@2C 


0095 


A6CA56 


0046 BOO95 CP 


R0A,#56 


0098 


C2CBFA 


0047 


CPIJE 


ROB, @R0C. $0095 


009B 


D2ED00 


0048 


CPIJNE 


: R0D,@R0E,S009E 


009E 


402F 


0049 B009E DA 


2F 


OOAO 


40CF 


0050 


DA 


ROF 


00A2 


4130 


0051 


DA 


@30 


00A4 


0031 


0052 


DEC 


31 


00A6 


OOCO 


0053 


DEC 


ROO 


O0A8 


0132 


0054 


DEC 


@32 


OOAA 


80C2 


0055 


DECW 


RR02 


OOAC 


943736 


0056 


DIV 


36,37 


OOAF 


94C53A 


0057 


DIV 


3A,R05 


00B2 


94C7C6 


0058 


DIV 


RR06,R07 


00B5 


953EC8 


0059 


DIV 


RR08,@3E 


00B8 


969ACA 


0060 


DIV 


RROA , #9A 


OOBB 


BAOO 


0061 


DJNZ 


ROB.SOGBD 


OOBD 


20C3 


0062 BOOBD INC 


RO3 


OOBF 


AO'12 


0063 


INCW 


42 


OOCl 


AOCE 


0064 


INCW 


RROE 


00C3 


AI43 


0065 


INCW 


@43 


00C5 


BF 


0066 


IRET 




00C6 


1D4321 


0067 


JP 


LT,$4321 


00C9 


7D1111 


0068 


JP 


ULT,$1111 


OOCC 


8D3333 


0069 


JP 


$3333 


OOCF 


9D2233 


0070 


JP 


GE,$2233 


00D2 


FD8899 


0071 


JP 


UGE.$8899 


00D5 


3044 


0072 


JP 


@44 


00D7 


6B00 


0073 


JR 


EQ,$00D9 


00D9 


EBOO 


0074 B00D9 JR 


NE,$00DB 


OODB 


18C2 


0075 BOODB LD 


R01,R02 


OODD 


C745 


0076 


LD 


R04 , @R05 
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LOG 


OBJ 


LINE LABEL SOURCE CODE 


OODF 


E44847 


0077 


LD 


47,48 


00E2 


984a 


0078 


LD 


R09.4A 


00E4 


E54c4b 


0079 


LD 


4b,@4c 


00E7 


D64EF0 


0080 


LD 


@4E.ffF0 


OOEA 


F5504F 


0081 


LD 


@4f,50 


OOED 


87DFCE 


0082 


LD 


ROD,CE{ROF) 


OOFO 


9743C2 


0083 


LD 


C2{R03),R04 


00F3 


4768C7 


0084 


LDB 


R06,R07,#4 


00F6 


47ADC9 


0085 


LDB 


R09,#6,ROA 


0OF9 


C3DF 


0086 


LDE 


ROD,@RROE 


OOFB 


D333 


0087 


LDE 


@RR02,R03 


OOFD 


E74610 


0088 


LDC 


R04,$10(RR06) 


0100 


E77920 


0089 


LDE 


R07.$20(RR08) 


0103 


A7DE3412 


0090 


LDC 


ROD. $1234 (RROE) 


0107 


A7F37856 


0091 


LDE 


ROF,$5678{RR02) 


OlOB 


A7700010 


0092 


LDC 


R07,$1000 


OlOF 


A7810020 


0093 


LDE 


R08,$2000 


0113 


E2BC 


0094 


LDCD 


rob,@rroc 


0115 


E2DF 


0095 


LDED 


ROD,@RROE 


0117 


E3F0 


0096 


LDCI 


ROF,@RROO 


0119 


E313 


0097 


LDEI 


R01,@RR02 


OllB 


F234 


0098 


LDCPD 


@RR04,R03 


OllD 


F257 


0099 


LDEPD 


@RR06.R05 


OllF 


F378 


0100 


LDCPI 


@RR08,R07 


0121 


F39B 


0101 


LDEPI 


@RR0A,R09 


0123 


C4CE5A 


0102 


LDW 


5A,RR0E 


0126 


C4C2C0 


0103 


LDW 


RR00,RR02 


0129 


C55D5C 


0104 


LDW 


5C,@5D 


012C 


C6C60020 


0105 


LDW 


RR06;#0020 


0130 


846162 


0106 


MULT 


62,61 


0133 


84CBCA 


0107 


MULT 


RR0A,R0B 


0136 


8568CC 


0108 


MULT 


RR0C,@68 


0139 


863O6A 


0109 


MULT 


6A,#30 


013C 


OF 


0110 


NEXT 




013D 


42FO 


0111 


OR 


ROF.ROO 


013F 


4312 


0112 


OR 


R01,@R02 


Ol4l 


456FC5 


0113 


OR 


R05,@6F 


0144 


46C660 


0114 


OR 


R06.#60 


0147 


50C7 


0115 


POP 


RO7 


0149 


5172 


0116 


POP 


@72 


014b 


9275C8 


0117 


POPUD 


R08,@75 


014e 


9378C9 


0118 


POPUI 


R09,@78 


0151 


7079 


0119 


PUSH 


79 


0153 


827DCB 


0120 


PUSHUD 


@7D,R0B 


0156 


837E7F 


0121 


PUSHUI 


@7E.7F 


0159 


CF 


0122 


RCF 
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LOG 


OBJ 


LINE LABEL SOURCE 


; CODE 


015A 


9081 


0123 


RL 


81 


015c 


lOCE 


0124 


RLC 


ROE 


015E 


1184 


0125 


RLC 


@84 


0160 


EO85 


0126 


RR 


85 


0162 


COCO 


0127 


RRC 


ROO 


0164 


C188 


0128 


RRC 


@88 


0166 


4f 


0129 


SBO 




0167 


5F 


0130 


SBl 




0168 


3334 


0131 


SBC 


R03,@R04 


016A 


34C58B 


0132 


SBC 


8b,R05 


016D 


358F8E 


0133 


SBC 


8E,@8F 


0170 


369170 


0134 


SBC 


91. #70 


0173 


DF 


0135 


SCF 




0174 


D0C8 


0136 


SRA 


R08 


0176 


DI93 


0137 


SRA 


@93 


0178 


3190 


0138 


SRP 


#90 


017A 


31A2 


0139 


SRPO 


#A0 


017c 


3IBI 


0140 


SRPl 


#bo 


OI7E 


23BC 


0141 


SUB 


R0B,§R0C 


0180 


24CEB3 


0142 


SUB 


B3,R0E 


0183 


25COCF 


0143 


SUB 


ROF.gCO 


0186 


26C2D0 


0144 


SUB 


R02,#D0 


0189 


F0D4 


0145 


SWAP 


d4 


OI8B 


6367 


0146 


TCM 


R06,@R07 


OI8D 


64D9C8 


0147 


TCM 


R08,D9 


0190 


65DCDB 


0148 


TCM 


DB,@DC 


0193 


66E3E0 


0149 


TCM 


E3,#E0 


0196 


72CD 


0150 


TM 


ROC. ROD 


0198 


76C255 


0151 


TM 


R02.#55 


019B 


3F 


0152 


WFI 




019c 


B234 


0153 


XOR 


R03.R04 


019E 


B356 


0154 


XOR 


R05,@R06 


OlAO 


B4F3C7 


0155 


XOR 


R07,F3 


01A3 


B5F6F5 


0156 


XOR 


F5.@f6 


01A6 


B5F7C9 


0157 


XOR 


R09,@F7 


01A9 


B6FFDD 


0158 


XOR 


FF,#DD 


OlAC 


B6CAEE 


0159 


XOR 


R0A,#EE 
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Appendix M 
Breakpoint Processor Board (BPP) 



M.l Introduction 



MICROTEK'S Breakpoint Processor (BPP) is a comprehensive breakpoint control 
unit for all MICE-II emulators. The BPP is an optional single card PCB that 
features sophisticated breakpoint logic. It includes up to 120 new break- 
point constructs for more flexibility in target system debug and development. 
The BPP also includes external hardware triggering and an execution interval 
timer. This powerful triggering system helps you to quickly solve the most 
difficult software and hardware problems. 

Breakpoint conditions designating precise events can be logically joined 
with ARM/ AND/OR connectives, permitting you to - 

* begin or end tracing 

* activate another event group 

* specify delayed trigger count 

* initiate event coxinter 

* use external signal as trace trigger 

* send trigger signal to external device 

* record execution time between 2 events 

* break emulation 

Flexible trigger constructs are used to define single events, multiple 
activities or hardware sync signals. These powerful triggers make it easy to 
specify complex processor and hardware events. Data breakpoints can be set 
for address, data, status, count and delay. While external hardware break- 
point can specify up to 2 triggers (each with any combination of 2 signals). 

The breakpoint system combines a large number of trigger events, permitting 
you to begin trace or break emulation on the following activities - 

* Address 

* Data bus 

* Delay Count 

* Event Counter (trigger match) 

* Microprocessor Status Lines (Fetch, Read, Write, Input, Output, Interrupt 

Acknowledge) 

* Logically Joined Breakpoints 

* Sequence Levels 

* Logic State Input 



M.2 Breakpoint Characteristics 
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M.2 Breakpoint Characteristics 

The BPP includes 4 breakpoints {H3-H6) and 2 triggers for transmitting a 
sync signal to an external device (BS1,BS2). MICE-II's other two breakpoints 
(H1,H2) can also be combined. H3-4 are data breakpoints (sync triggers), H5- 
6 are the external hardware breakpoints, and BSl-2 are sync signal triggers. 

M.2.1 Breakpoint Syntax 

H3 [addx [data [<dbwc> ][status [count]]]] 

Ek [addx [data [<dbwc> ][status [delay]]]] 

H5 [xx] - 2 spare bits (XI, XO) 

H6 [xx] - 2 spare bits (X3,X2) 

BSl [addx [data [<dbwc> ][status]]] 

BS2 [addx [data [<dbwc> ] [status]]] 

addx - up to 5 digit hex address with wildcard byte pair of "XX" , or with 
wildcard nibble of "X" for the fifth digit only (i.e. X2345) . 

data - up to 't digit hex data. 

dbwc - up to 4 digit hex setting with binary "0" as wildcard for correspond- 
ing data bit. 

status - tj^e of processor activity with wildcard "X". 

count - trigger count; range l-^OOOH. 

delay - cycle count delay; range 2-FFFFH. 

spare bits - enabled at HIGH, LOW or wildcard (1/0/X). 

M.2. 2 Data Breakpoints 



These breakpoints are latched on the rising edge of a STROBE signal from the 
GEP board. When the breakpoint is matched, emulation stops and a SYNC signal 
is transmitted. If a trigger count or cycle delay is defined in H3 or H4, 
then the input value must be matched before the breakpoint is activated. 
This method is most useful for tracing data after all other trigger condi- 
tions have been matched. 

M.2. 3 External Hardware Breakpoints 

H5 and H6 use two external signal groups on the CEP board (XI, XO and X3,X2 
respectively). HIGH, LOW or "don't care" can be defined for these signals. 
Hardware breakpoints are latched when the specified logic state occurs. 

M.2. 4 Halt Breakpoints 

Hl-6 can serve as Individual Halt breakpoints for B, F or G commands. HI and 
H2 (defined prior to BT) can also be used to add another logical OR to the 
trigger construct. 



M-2 



M.3 Breakpoint Trace Logic 

Breakpoints H3-H6 are used in logical combination with the "BT" command. 
Tracing begins at the current address as soon as the command is input 
(Backward Tracing) and continues until the specified breakpoints are matched. 
Each logical connective is used as follows: 

1) AEM Trigger Trace 

>BT A[ B[ C[ D]]]* 

Breakpoints can be logically joined in any armed sequence (except that 
they can't be repeated). There are 64 different ARM trigger combinations. 

*A-D can represent any of H3~6. 

2) AND Trigger Trace 

>BT (A B C) [D] 
>BT (A B) [C [D]] 

Breakpoints A-D can be combined as indicated above in any combination. 
Sequence breakpoints may also be specified after the AND trigger con- 
struct. There are 38 different AND trigger combinations. 

3) OR Trigger Trace 

>BT <A B C> 

>BT <A B> [C [D]] 

The OR trigger may use any breakpoint combination. Sequence breakpoints 
may also be specified after the OR trigger construct. When a Sequence 
trigger is used with the OR trigger construct, the ORed pairs must be 
either data (H3,H4) or external breakpoints (H5,H6). There are 18 differ- 
ent OR trigger combinations. 

M.4 Breakpoint Interval Timer 

A timer is also supported for trigger trace mode which displays the interval 
from the initial trigger until emulation stops. (The interval will display 

i~ir\ 1-iT t,ir»/*il-lf:\ •3 CI f:\ r^ 1 1 r:\r\ r-t /~, 1^ Irw^r^ r^lrr-tr^-i n ^ -I.-. r-t ,-^ -t- \ 

seconds for up to 35-39 minutes before the counter is reset. 
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M.5 External Hardware Trigger Output 

The BS command can be used to trigger a SYNC signal to an external device 
e.g. oscilloscope or logic analyzer. When the specified parameters are 
matched, a SYNC signal is transmitted and emulation continues. 
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Appendix N 
Error Messages 



1) ADDRESS xxxx RAM ERROR! 

Condition: Memory addressed in Memory Test (T) command failed. 

Recovery: Verify that specified address is write enabled RAM; and then 
see if the address bus and/or data bus are open or shorted. 

2) BACKWARD TRACE FAILS! 

Condition: Trace buffer is empty when the breakpoint is matched, or 
<ESC> is input, or the processor is stopped without stepping 
any machine cycles. 

Recovery: See if the READY signal is always inactive, or the HOLD 
signal is always active. Then see is the trigger address or a 
specified breakpoint (H1~h6) was matched immediately. 

3) BC TABLE FULL 

Condition: Instructions branched to and called in the disassembly command 
exceed 900. 

k) BUS REQUESTING! 

Condition: Target bus requesting signal always active. 

Recovery: Verify that target has a bus request signal. 

5) COMMAND TOO LONG! 

Condition: Instruction string in assembly command exceeds 50 characters. 

6) ERROR! 

Condition: Command syntax error. 

7) ERROR CODE! 

Condition: Instruction error in disassembly command. 
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8} ERROR CODE, TRY AGAIN! 

Condition: Instruction error in assembly command. 

9) FORWARD TRACE FAILS! 

Condition: Trace buffer is empty when the breakpoint is matched, or 
<ESC> is input, or the processor is stopped without stepping 
any machine cycles. 

Recovery: See if the trigger address was invalid, or a specified break- 
point was matched before the trace started. 

10) Hx NOT SET! 

Condition: Specified breakpoint not set prior to executing BT command. 

11} MEMORY SEARCH FAILURE! 

Condition: Data string not found within specified address range for 
Memory Search (M) command. 

12) MEMORY VERIFICATION FAILURE! 

Condition: Data cannot be written to address memory in Modify (M) command. 
Recovery: Verify that specified address is valid and write enabled. 

13) MEMORY WRITE FAILURE! 

Condition: Data cannot be written to addressed memory in assembly com- 
mand. 

Recovery: Verify that specified address is valid and write enabled. 

14) NO BPP CARD! 

Condition: BPP commands cannot be executed without a BPP card. 

15) PROGRAM HALT! 

Condition: Emulation processor halted by instruction. 

Recovery: Use an interrupt or reset to recover; then perform a trace to 
see where the HALT instruction occurred. 
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16) TARGET CAN'T STEP! * 

Condition: Emulation processor does not respond after applying power or 
inputting the software reset command "r" {see section 2.10). 
There is a problem with emulation processor that prevents a 
program from executing; there are several possibilities which 
can generate this message: 

a) There is no clock. 

b) There is a problem with the address line. 

c) Target does not support the "ready" signal. 

d) There is a problem with the RTT, CEP or HUEM/UEM board. 

e) Other component failure. 

Recovery: Check to be sure the emulation processor clock signal is cor- 
rect and verify that the clock source selection switch is 
properly adjusted (see CEP Placement Chart in the appropriate 
appendix for switch location) . 

17) TARGET IS NOT READY! 

Condition: Target memory or input/output ready signal is inactive. 
Recovery: Use a valid physical location in the command specification. 

18) Ux — FAILURE! * 

Condition: MICE self test indicates location number for failure device. 
Recovery: Contact your nearest Microtek distributor for assistance. 

19) WARNING: ONLY 6 BYTES ARE VALID 

Condition: Define byte (DB) in assembly command exceeds 6 bytes. 

20) WHAT? * 

Condition: RS-232C communication with parity or framing error. 
Recovery: Check interface setting for communications at UI3. 

•Potentially fatal error; if problem cannot be resolved, contact your near- 
est Microtek distributor for assistance. 
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APPENDIX 
Warranty and Service 



0.1 Warranty 

Microtek International, Inc. (Mil) warrants this product to be free from de- 
fects in material or workmanship for a perid of 365 days from the date of 
original purchase. This warranty applies only to the original purchaser who 
bought this unit from Microtek or its duly authorized agents and dealers. If 
the unit is found to be defective during the warranty period, obtain author- 
ization for return from an Mil product service or support engineer. Then 
return the unit for repair to Mil, or an authorized Mil dealer or represen- 
tative, along with proof of purchase and purchase date. Products covered by 
this warranty will be repaired free of charge. The warranty shall be voided 
if the unit has been subjected to improper or abnormal use, if the xinit is 
altered or modified in any way, or any attempt is made to repair the unit 
without proper authorization from Mil. 

WlCrOteK. i3 auxt? uDxxgctU-LUii uiiacj." oiixa warrcuiu^ xo ot_» xc^axj. yji- , d^ -i. i^£> vA-i.e> 

cretion, to replace a defective product. Mil makes no other warranties, ex- 
press or implied, including but not limited to any implied warranites of 
merchantability or suitability for particular applications. In no event 
shall Mil be liable for loss of profits or of other benefits, or for any 
other damages, consequential or incidental, arising out of any breach of 
this warranty, or use or possision of this product by the user. 

To validate this warranty, please fill out and mail the enclosed user regis- 
tration card. If this card is not mailed and recieved by Mil, this warranty 
will only be valid for a period of 365 days following the date of shipment 
from the factory. 



0.2 Service 

Microtek's responsibility in the event of defect is limited to correction of 
defects by adjustment, repair or replacement at Microtek's sole expense and 
discretion for a period of 365 days following the date of purchase. Repair 
of products out of warranty, and firmware updates, are provided at a set 
rate. 
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APPENDIX P 
MICE International Distributors 
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ARGENTINA 

MICROTEC INGENIERIA S.R.L. 

VIAMONTE 1167, 8° P. OF. 31 

(1053) BUENOS AIRES 

ARGENTINA 

TEL: 54 (1) 46-8749/45-1934 

TLX: 22496 TECNOS AR 



BRAZIL 

DIGIBYTE SISTEMAS DIGITAIS LTDA. 
Y 32 RUA PALACETE DAS AQUIAS, 494 
CEP 04635 

SAO PAULO, S.P., BRAZIL 
TEL: 55 (Oil) 241-3611 
TLX: 1153972 DGBT BR 



AUSTRALIA 

MACRO DYNAMICS PTY LTD. 

80 LEWIS RD., WANTIRNA SOUTH 

P.O. BOX 336, BAYSWATER 3153 

MELBOURNE, AUSTRALIA 

TEL: 61 (03) 2207260 

TLX: 30674 METO AA 



CANADA 

TRACAN ELECTRONICS CORP. 
1200 AEROWOOD DR., #4 
MISSISSAUGA, ONTARIO 
L4W 2S7 CANADA 
TEL: 1 (4l6) 625-7752 
TEX: 961366 



AUSTRIA 

ALLMOS ELECTRONIC GMBH. 

1100 VIENNA, 

TROSTSTRASSE 50/3 RD FLOOR 

VIENNA, AUSTRIA 

TEL: 43 (222) 627 19 54 

TLX: 112757 



CHILE 

EQUIPOS INDUSTRIALES S.A.C.I. 
MONEDA 812 - OF. 905 
CASILLA 13550 
SANTIAGO CHILE 
TEL: 56 (2) 382942 
TLX: 241282 FLOBR CL 



BELGIUM 

SIMAC ELECTRONICS B.V. 

1210 BRUSSELS, BELGIUM 
TEL: 32 (02) 219 24 53 
TLX: 23662 



dIenmark 

metric a/s 
naerum, denmark 

TEL: 45 (02) 80 42 00 
TLX: 37163 
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FINLAND 



ISRAEL 



NURMIKRO KY 

VAINOLANTIE 5 

01900 NURMIJARVI FINLAND 

PUHELIN 

TEL: 358 (0) 20^981 

TLX: 15132 PERO SF 



ARITMOR 

54, JABOTINSKY ST. 

RAMAT-GAN 52462 

ISRAEL 

TEL: 972 (03) 727317 

TLX: 342369 CVSIL 



FRANCE 



ITALY 



MICRO TECHNOLOGIE ELECTRONIQUE 

3F, 68, RUE DE PARIS 

93804 EPINAY-SUR-SEINE CEDEX 

FRANCE 

TEL: 33 (1) 823.15.24 

TLX: 613615 MTE F 



PRATICA SRL 

CORSO RE UMBERTO, 

79-10128 TORINO, 

ITALY 

TEL: 39 (Oil) 50.34.27 

TLX: 212163 



HONG KONG 

CHAI LUK COMPUTER LTD. 
16TH FLOOR, UNIT A-B, 
VICWOOD BUILDING, 
128 BLOUCESTER ROAD 
HONG KONG 

TEL: 852 (5) 751151/752172 
CABLE: "HKCHAILUK" 
TLX: 84960 CHAIL HX 



TEKNO SCUOLA SRL 
(EDUCATIONAL MARKET ONLY) 
VIA DELLA BONIFICA N. 104-106 
65100 PESCARA, ITALY 
TEL: 39 (085) 693510 
TLX: 600878 
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CHAPTER 1 
INTRODUCTION 



Microtek's BreakPoint Processor (BPP) is a comprehensive breakpoint control 
unit for all MICE-II emulators. The BPP is an optional single card PCB that 
features sophisticated breakpoint logic. It includes up to 120 new break- 
point constructs for more flexibility in target system debug and development. 
The BPP also includes external hardware triggering and an execution interval 
timer. This powerful triggering system helps you to quickly solve the most 
difficult software and hardware bugs. 

Breakpoint conditions designating precise events can be logically joined 
with ARM/ AND/OR connectives, permitting you to - 

* begin or end tracing 

* activate another event group 

* specify delayed trigger count 

* initiate event counter 

* use external signal as trace trigger 

* send trigger signal to external device 

* record execution time between two events 

* break emulation 

Flexible trigger constructs can be used to define single events, multiple 
activities or external hardware signals. These powerful triggers make it 
easy to specify complex processor and hardware sequences. Data breakpoints 
can be set for address, data, status, count and delay. While external" hard- 
ware breakpoints can specify up to two triggers (each with any combination 
of two signals) . 

This breakpoint system combines a large number of trigger events, permitting 
you to begin target trace or break emulation on the following activities - 

* Address Bus 

* Data Bus 

* Delay Count 

* Event Counter (trigger match) 

* Microprocessor Status Lines (Fetch, Read, Write, Input, '^utput and Inter- 
rupt Acknowledge) 

* Logically Joined Breakpoints 

* Sequence Levels 

* Logical State Input 



1-1 



1.1 Installation 

The BPP is a multilayer board that must be added as the second board in the 
MICE-II module. 

To install the BPP board, first remove the cover to the MICE-II case. With 
the power off, disconnect the two ribbon cable connectors; then remove the 
CEP and RTT boards. Replace the original brass spacers with the new ones 
provided with the BPP board. Reassemble all boards back into the MICE case, 
inserting the BPP board between the CEP and RTT boards. Then attach the new 
ribbon cable connectors (supplied with the BPP) firmly to each board. 



Note: 



We recommend leaving the cover of the MICE-II case off when using four 
boards, otherwise overheating may cause intermittent problems in ope- 
ration. 




NEW RIBBON 
CABLE 




NEW RIBBON 
CABLE 



1.2 Electrical and Environmental Specifications 

Electrical Characteristics 



Power 

Maximum current 



+5 VDC 
1.3 Amp 



Note: When an 8-bit MICE-II model with BPP board installed is used with the 
optional fan (provided by Microtek), power consumption Is as indicated 
below. (Supersedes information in MICE-II User's Guide, section 2.2), 

p )wer Requirements 
+ 'jV )C at 4.0A (maximum) 
+12VDC at 0.3A (maximum) 
-12VDC at O.IA (maximum) 



Environmental Characteristics 

o o 
Operating temperature -SC C 

Storage temperature -10 -65" 

Relative humidity IQ-'-ZZ 



(32°-122°F) 
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CHAPTER 2 
BPP FUNCTIONS 



The BPP includes four breakpoints (H3-H6), two triggers for transmitting a 
sync signal to an external device (BS1-BS2) , and a Breakpoint Trigger Trace 
command (BT). 

MICE-II's other breakpoints (H1/H2) can be combined with the BPP commands; 
and H2-H6 can also serve as individual breakpoints for B/F/G commands (note 
that HI can not be used for B/F commands). 

2.1 Halt Breakpoints and Breakpoint Commands 

Breakpoints: ' 

H3/H4 are data breakpoints. 

H5/H6 are external hardware breakpoints. 

Commands : 

BS is the Breakpoint Sync command. It outputs a sync signal (to an external 
device) when the specified trigger condition is matched. 

BT is the Breakpoint Trace command. It begins tracing from the current 
program address up to the specified trigger condition (Backward Trace). 



?B is the command to display BPP syntax as illustrated below: 

>?B 

BP <addrl[ addr2[ addr3[ addr4]]]> [IDT = al] * 

H ?|[0][3|4|5|6] 

H3 addx[ data[ <dbwc>][ q[ cnt]]] 

H4 addx[ data[ <dbwc>][ q[ dly]]] 

H5 XX 

H6 XX 

BS ll2[ addx[ data[<dbwc>][ q]]] 

BT A[ B[ C[ D]]] 

BT <A B C> 

BT <A B>[ G[ D]] 

BT (A B)[ C[ D]] 

BT (A B C)[ D] 

A-D ARE ANY OF H3-6 

* BP (Execution Breakpoint) is a MICE-II command available for all 16-blt 
MICE-II models, MICE-II firmware version 3.0 and later. Note that IDT 
defines the base value of the Interrupt Descriptor Table (80286 only). 

2.2 Breakpoint Syntax 

For H3/H4 

addx - is an up to 6 digit hex address with an optional byte pair of "XX". 

data - is up to 4 digit hex data. 

<dbwc> - is an up to 4 digit hex setting; interpreted as 16 binary data 
bits, where "0" indicates "don't care". 

q - is a qualifier for the type of processor activity, where "X" indi- 
cates "don't care". 

cnt - is a trigger count; the range is 1-4000H (for nth match). 

dly - is a cycle count delay; the range is 2-FFFFH. 

For a detailed description refer to section 2.3. 

For H5/H6 

H5 [xx] - are 2 spare bits (XI and XO). 
H6 [xx] - are 2 spare bits (X3 and X2). 

Spare bits are monitored signals input from stick headers XO-3 on the CEP 
board. They can be set to match signal input at HIGH, LOW or "don't care" 
(1/0/X). For a detailed description refer to section 2.4. 
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2.3 Data Breakpoints (H3/H4) 



H3 [addx[ data [<dbwc>][ qualifier [ count]]]] 
H4 [addx[ data [<dbwc>][ qualifier [ delay]]]] 



H3 is the command for a Data Breakpoint with an optional event count. 
H4 is the command for a Data Breakpoint with an optional cycle delay. 



addx 



data 



<dbwc> 



qualifier 



count 



delay 



is the trigger address where emulation is to stop. This can be an 
up to six digit hex address with an optional byte pair of "XX". 
(The maximum address length depends on the address range for the 
current emulation processor.) 

is up to 4 digit hex data to be matched with the trigger address. 
(For 8-bit processors, maximum data length is up to 2 hex digits.) 

is an up to 4 digit hex setting indicating a "data bit wildcard". 
(For 8-bit processors, the setting may up to 2 hex digits.) To 
enter any <dbwc>, a data value must first be defined 
bit wildcard is interpreted as 16 binary data bits, 
indicates "don't care". The default value for the dbwc is FFFFH 
(For 8-bit processors the default is FFH.) 



The data 
where "0" 



is a single or double alphabetic character indicating the type of 
processor activity to be matched with the trigger address. (If a 
count or delay is to be input, an "X" may be used in the status 
specification to indicate "don't care".) 

For a complete listing of qualifiers applicable for a parti- 
cular processor, refer to the appropriate appendix in the MICE-II 
User's Guide. 

is a hexadecimal value from 1-4000H that specifies the number of 
times the target condition must be matched before the trace stops. 
To enter a count, a qualifer must first be defined. 

is a hexadecimal value from 2-FFFFH that specifies a cycle count 
delay. After all other trigger conditions have been matched, the 
trace will continue until the specified cycle count has expired. 
To enter a delay, a qualifier must first be defined. 



The breakpoints H3 and H4 are latched on the rising edge of a STROBE signal 
from the CEP board. When the breakpoint is activated, emulation stops at the 
end of the next bus cycle. (See Appendix C for a detailed description of 
break operation.) If a trigger count or cycle delay is defined, then the 
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specified value must also be matched before the breakpoint is activated. 
This method is useful for tracing data after all other trigger conditions 
have been matched. 

When the specified break condition is matched, a sync signal is output. Note 
that delay is not calculated for the sync signal; as soon as all other trig- 
ger conditions are matched, the sync signal is transmitted without waiting 
for the specified delay to transpire. A count, however, specifies the number 
of times a sync signal will be transmitted. Everytime the trigger condition 
is matched and the count incremented, and a sync signal is output. 

The following sample program for an 8086 target is used as the basis for all 
the examples listed in this user's guide. This program includes commonly 
used Instructions for performing various bus cycles. Without a target sys- 
tem connected, it executes in a simple loop. 



>Z0 16 












; Disassemble program. 


LOG 


OBJ 


LINE 


LABEL 


SOURCE 


CODE 




0000:0000 


90 


0001 


BOOOO 


NOP 




;No operation. 


0000:0001 


90 


0002 




NOP 






0000:0002 


90 


0003 




NOP 






0000:0003 


90 


0004 




NOP 






0000:0004 


BAOOOl 


0005 




MOV 


DX,#0100 


;Set DX=100H. 


0000:0007 


ED 


0006 




IN 


AX.DX 


; Input from port DX 


0000:0008 


90 


0007 




NOP 




; to register AX. 


0000:0009 


90 


0008 




NOP 






0000:000A 


EF 


0009 




OUT 


DX.AX 


; Output from AX to DX. 


0000:000B 


B90200 


0010 




MOV 


GX,#0002 


;Set CX=2H. 


0000:000E 


A30003 


0011 


BOOOE 


MOV 


0300, AX 




0000:0011 


2D0200 


0012 




SUB 


AX, #0002 


;AX=AX-2H. 


0000:0014 


E2F8 


0013 




LOOP 


OOOE 


;If AX?^0 jump to OEH. 


0000:0016 


EBEB 


0014 




Turrt 
Ui'lr 


0000 


; Return to OOOOOH. 


DISASSEMBLY 
> 


COMPLKrEB 
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Example 1: Use the "H?" command to display all breakpoint settings; then set 
H3 at address OOOOOH and begin program execution. 

>H? ; Display HI -6 settings. 

Hl= 
H2= 
H3= 
H4= 
H5= 
H6= 

>H3 ;Set H3 at OOOOOH, for any data and any status. 

>H3 ; Display H3 setting. 

H3= 

>R ;Examine the registers prior to program execution, 

AX=FFFF BX=FFFF CX=0000 DX=0100 SP=0000 BP=FFFF SI=FFFF DI=FFFF 
DS=0000 SS=0000 ES=0000 CS=0000 IP=0000 FS=F002 PC=00000 
>G ; Breakpoint matched at OOOOOH; emulation stopped at 00002H. 

PfOGRAM BROKE AT BREAKPOINT-3 

>C ; Cycle command steps the program to address 00004H. 

~ ADDRESS DATA STATUS SPARE DMA FLUSH 

00004 OOBA S 1111010 
> 

Note: For the 8086/88, if H3/H4 has been set and the trigger condition is 
matched at the current cycle, the CPU will stop at the next cycle (see 
Appendix C) . 

Example 2: Set H3 for any address with "don't care" and data for 9090. (Note 
that without a dbwc, all binary bits of the specified data value 
are qualified.) 

>J0 ; Reset the IP to OOOOH. 

>H3 XXXX 9090 ;Use H3 to break at data 9090H. 

>£ 

PROGRAM BROKE AT BREAKPOINT-3 

ADDRESS DATA STATUS SPARE DMA FLUSH 
00004 OOBA S 1111010 
> 
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Example 3: Set H3 with address and data of "don't care"; then set the status 
to Port Input with a count of 3. 

>J0 ; Reset the IP to OOOOH. 

>H3 XXXX FFFF <0> I 3 ;H3 set to break on 3rd input cycle. 

>G ;OUT DXjAX prefetched but not executed. 
PROGRAM BROKE AT BREAKPOINT-3 

>C ;OUT DX.AX executed by Cycle command. 

ADDRESS DATA STATUS SPARE DMA FLUSH 

00100 FFFF 11110100 
> 

Example 4: Set H4 to address lOOH with a data bit wildcard that qualifies 
bit 1 only; then set the status to Port Output with a delay of 2. 

>J0 ; Reset the IP to OOOOH. 

>H4 100 FFFF <2> 2 ;H4 set for address lOOH, data "xxxx xxxx xxxx xxlx", 

output status and a delay of 2. 
>H4 ; Display the setting for H4. 

H4= 100 FFFF <2> 2 

>G 

PROGRAM BROKE AT BREAKPOINT-4 

>c 

ADDRESS DATA STATUS SPARE DMA FLUSH 
00300 FFFF W 11111110 
> 
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2.4 External Hardware Breakpoints (H5/H6) 

H5 [xx] 
H6 [xx] 



H5 is the command for an External Hardware Breakpoint set by monitored sig- 
nals at XI and XO on the CEP board. 



I } 

XX indicates spare bit "XI" and spare bit "XO". 

I t 

H6 is the command for an External Hardware Breakpoint set by monitored sig- 
nals at X3 and X2 on the CEP board. 



I ^ } 

XX indicates spare bit "X3" and spare bit "X2". 

I t 

The breakpoints H5 and H6 use two external signal groups on the CEP board 
(Xl/XO and X3/X2 respectively). Mini-jumpers provided with the BPP can be 
used to connect from these test points to the target. The monitored signals 
are called spare bits and support concurrent trace for address, data and 
status bus. Any of these bits can be monitored to provide hardware status 
based on machine cycles. Hardware breakpoints are latched when the specified 
logic state occurs. 

The spare bits input from stick headers XO-3 on the CEP board can be set to 
match signal input at HIGH, LOW or "don't care" (1/0/X), where 

1 = high level 

= low level 

X = don't care (either 1 or 0) 

Note: Input signals to XO-3 must meet specifications for the Schmitt trigger 
IC - 74LS132. 

To demonstrate External Hardward Breakpoints in the following examples, jum- 
pers are connected to the CEP board of a MICE-II 8086. The spare bits XO, 
XI, X2, X3 are configured as shown below: 

XO is connected to U57-2 (CEP 8086 SOA signal) 

XI is connected to U57-6 (CEP 8086 S2A signal) 

X2 is connected to U57-5 (CEP 8086 SIA signal) 

X3 is connected to U57-6 (CEP 8086 S2A signal) 
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Note: S0-S2 are latched by the ALE (Address Latch Enable) of 74LS373 (U57), 
and are output according to the controlled CPU status as S0A-S2A. 

SOA reflects SO 
SIA reflects S]_ 
S2A reflects S2 

The following table on 8086/88 bus cycles is a reference for checking the 
status of spare bits. 



8086/88 Bus Cycle Status 


S2 


SI 


so 


Bus Cycle Initiated 











Interrupt Acknowledge 








1 


Read I/O 





1 





Write I/O 





1 


1 


Halt 


1 








Instruction Fetch 


1 





1 


Read Data from Memory 


1 


1 





Write Data to Memory 


1 


1 


1 


Passive (no bus cycle) 



Example 1: Use H5 to break emulation on an I/O Read cycle by setting the in- 
put trigger at 01 for Xl/XO. 



;Clear Hl-6. 

; Reset the IP to OOOOH. 

;Set break condition for X1=0 and X0=1. 



>H0 
>J0 
>H5 01 

>G 

PROGRAM BROKE AT BREAKPOINT-5 

>£ 

ADDRESS DATA STATUS SPARE DMA FLUSH 
00100 FFFF 11110100 
> 

Example 2: Use H6 to break emulation on an I/O Write cycle by setting the 
input trigger at 01 for X3/X2. 



>J0 
>H05 
>H6 01 

>£ 

PROGRAM BROKE AT BREAKPOINT-6 

>c 

ADDRESS DATA STATUS SPARE DMA FLUSH 
00010 2D03 S 11111010 
> 



;Reset the IP to OOOOH. 

; Clear H5. 

;Set break condition for X3=0 and X2=l. 
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CHAPTER 3 
BREAKPOINT TRACE LOGIC 



3.1 Breakpoint Trace - BT 



Refer to the following sections for description of syntax. 

BT is the command for Breakpoint Tracing. 

Breakpoint Tracing begins at the current address (Backward Trace) and con- 
tinues until all the specified breakpoints are matched. H3-H6 must be set 
prior to command execution, and may be specified as a single breakpoint or 
in logical combinations (ARM/ AND /OR) with the BT command. Note that HI and 
H2 (specified prior to execution, and not within the BT command definition) 
can also be used to add another logical OR to the trigger construct (refer 
to the last example in section 3.1.1). The BPP performs the following types 
of tracing: 

Event Count Trace 
Delay Trigger Trace 
ARM Trigger Trace 
AND Trigger Trace 
OR Trigger Trace 
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3.1.1 Event Count Trace (with H3) 

The address, data and qualifier of a specific program event can be defined 
along with a count in the H3 breakpoint. When the Event Count trigger is 
enabled, it is added as a logical OR to the breakpoint parameters defined in 
B/F commands. When enabled and then defined in the BT command, it can be 
used alone or In any legal combination with other breakpoints. (Also refer 
to the example in section 3.1.3.) 

Example: Set break conditions for H3 at any address, any data. Write cycle 
and with a count of 2; then execute a trace using the BT command. 

>H3 XXXX FFFF <0> W 2 ;Set the event count trigger. 

>H? ; Display H1-H6 settings. 
Hl= 
H2= 

H3= XXXX FFFF <0> W 2 
H4= 

H5= 01 ;Set in previous example. 

H6= 01 ;Set in previous example. 

>J0 ; Reset the IP to OOOOH. 

>BTH3 ; Execute a Breakpoint Trace with H3. 
THE TRACE STOPS AT STEP 0014 

> L0 FFFF W ;List all Write cycles between 0-FFFFH 

; starting at frame 0. 

FRAME ADDRESS DATA STATUS SPARE DMA FLUSH 

OOOC 00300 FFFF W 11111110 

0013 00300 FFFD W 11111110 
> 

Example: Set the break condition for HI at address OH, then execute a trace 
again using the BT command. 

>J0 ; Reset the IP to OOOOH. 

>H1 ;Set HI to address OOOOH. 

>BTH3 

THE TRACE STOPS AT STEP 0000 

PROGRAM BROKE AT BREAKPOINT-1 ;Tracing is stopped by HI. 

> 
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3.1.2 Delay Trigger Trace (with H4) 

The address, data and qualifier of specific program activity can be defined 
along with a delay in the H4 breakpoint. When the Belay Trigger is enabled, 
it is added as a logical OR to the breakpoint parameters defined in the B/F 
commands. When enabled and then defined in the BT command, it can be used 
alone or in any legal combination with other breakpoints. (Also refer the 
example in section 3.1.3.) 

Example: Set the break conditions for H4 at address 300H, data FFFFH, Write 
cycle and with a delay of 5 machine cycles; then execute tracing 
using the BT command. 



>H4 300 FFFF W 5 



;Set a delay trigger. 



>H? 
Hl= 








; Display H1-H6 settings. 


H2= 

H3= XXXX FFFF <0> W 2 




;Set : 


Ln previous example. 


H4= 300 


FFFF W 


5 










H5= 01 














H6= 01 














>J0 








; Reset the 


IP to OOOOH. 


>BTH4 








; Execute a 


Breakpoint Trace with H 


THE TRACE STOPS 


AT STEP 0011 








>L 








;List 


all 


data in the trace buffer 


FRAME 


ADDRESS 


DATA 


STATUS 


SPATE 


DMA 


FLUSH 


0000 


00000 


9090 


S 


11111010 








0001 


00002 


9090 


S 


11111010 








0002 


00004 


OOBA 


S 


11111010 








0003 


00006 


EDOl 


S 


11111010 








0004 


00008 


9090 


S 


11111010 








0005 


OOOOA 


B9EF 


S 


11111010 








0006 


00100 


FFFF 


I 


11000001 








0007 


OOOOC 


0002 


S 


11111010 








0008 


OOOOE 


00A3 


S 


11111010 








0009 


00100 


FFFF 





11110100 








OOOA 


00010 


2D03 


S 


11111010 








OOOB 


00012 


0002 


S 


11111010 








OOOC 


00300 


FFFF 


w 


11111110 





; Setting matched. 


OOOD 


00014 


F8E2 


s 


11111010 










OOOE 


00016 


E8EB 


s 


1111 1010 








Trace delayed 


OOOF 


00018 


DBFF 


s 


11111010 








— >for 5 cycles 


0010 


OOOOE 


00A3 


s 


11111010 





1 


then stopped. 


0011 


00010 


2D03 


s 


11111010 











?_T 



3.1.3 Breakpoint Interval Timer 

A timer is also supported for trigger trace mode which displays the interval 
from the initial trigger until emulation stops. (The interval will only dis- 
play when an Armed breakpoint is encountered.) The timer can run for up to 
35.39 minutes before the counter is reset. Note that resolution for the in- 
terval is down to microseconds. Time interval message syntax is as follows: 

INITIAL TRIGGER TO BREAKPOINT INTERVAL— aa:bb:ccc:ddd 

wher-3: aa = minute 
bb = second 
ccc = millisecond 
ddd = microsecond 

Example: Display the execution interval for an Armed Trigger Trace. (Refer 
to section 3.2 for a description of the Arm Trigger.) 



>H? 






Hl= 






H2= 






H3= 


300 


FFFF W 


H4= 


300 


FFFD W 5 


H5= 


01 




H6= 


01 




>J0 
>BT H3 1 


^4 



THE TRACE STOPS AT STEP 0018 

INITIAL TRIGGER TO BREAKPOINT INTERVAL~00:00:000:006 

>LB 



'RAME 


ADDRESS 


DATA 


STATUS 


SPARE 


DMA 


FLUSH 


OOOB 


00012 


0002 


S ] 


LllllOlO 








OOOC 


00300 


FFFF 


W ] 


LllllllO 








GOOD 


00014 


F8E2 


S ■] 


LllllOlO 








OOOE 


00016 


E8WB 


S ] 


LllllOlO 








OOOF 


00018 


DBFF 


S ] 


LllllOlO 








0010 


OOOOE 


00A3 


S ] 


LllllOlO 





1 


0011 


00010 


2D03 


S ] 


LllllOlO 








0012 


00012 


0002 


S ] 


LllllOlO 








0013 


00300 


i'FFD 


W ] 


LllllOlO 








0014 


00014 


F8E2 


S ] 


LllllllO 








0015 


00016 


E8WB 


S ] 


LllllOlO 








0016 


00018 


DBFF 


S ] 


LllllOlO 








0017 


OOOIA 


0000 


S ] 


LllllOlO 








0018 


00000 


9090 


S ] 


LllllOlO 





1 



;H3 matched, timer starts. 



;H4 delay enabled. 



; Emulation stops after 
; 5 cycles; count ends. 
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3.2 Armed Trigger Trace - BT 



BT A[ B[ C[ D]]] 



A[ B[ C[ D]]] 



Breakpoints A-D (which represent any of H3-6) can be logical- 
ly joined in any Armed Trigger sequence. (The only exception 
being that they cannot be repeated). 



There are up to 64 different Armed Trigger combinations, 
is executed as follows - 



Sequential tracing 



if trigger A is matched, then trigger B is enabled; 
if trigger B is matched, then trigger C is enabled; 
and so on until the final breakpoint is matched. 

Example 1: Execute a trigger trace using the single breakpoint of H5 set 
(X1=0,X0=1). 



at 



>M 




: Rese 


t the if to uuuun 


>H? 




; Display H1-H6 setting: 


Hl= 








H2= 








H3= XXXX FFFF <0> W 


2 






H4= 300 FFFF W 5 








H5= 01 








H6= 01 








>BTH5 




; Execute trace. 


THE TRACE STOPS AT STEP 0006 




>L 




;List 


all traced data. 


FRAME ADDRESS DATA 


STATUS 


SPARE DMA 


FLUSH 


0000 00000 9090 


S 


11111010 





0001 00002 9090 


S 


11111010 





0002 00004 OOBA 


S 


11111010 





0003 00006 EDOl 


S 


11111010 





0004 00008 9090 


S 


11111010 





0005 OOOOA B9EF 


S 


11111010 





0006 00100 FFFF 


I 


11000001 






■^-s 



Example 2: Execute an armed trigger trace with a single sequence of H5 — >H6. 



>J0 

>BTH5 H6 

THE TRACE STOPS AT STEP 0009 

INITIAL TRIGGER TO BREAKPOINT INTERNAL-00:00:000:002 



; Reset the IP to OOOOH. 

;Specify H5 (X1=0,X0=1) and H6 (X3=0,X2=1). 



,5 








;List 


traced 


data from frame 5. 


■RAME 


ADDRESS 


DATA 


STATUS 


SPARE DMA 


FLUSH 




0005 


OOOOA 


B9EF 


S 


11111010 







0006 


00100 


FFFJ-' 


I 


11000001 





;H5 matched. 


0007 


OOOOC 


0002 


S 


11111010 







0008 


OOOOE 


00A3 


S 


11111010 







0009 


00100 


FFFf 





11110100 





;H6 matched. 



> 



Example 3: Execute an armed trigger trace using a sequence of two 
and a final breakpoint, i.e. H5 — >H6 — >H3. 



triggers 



>J0 








; Reset 


the 


IP to OOOOH. 




>BTH5 H6 H3 






; Settings displayed in 


Example 1. 


THE TRACE STOPS AT STEP 0014 










INITIAL TRIGGER TO BREAKPOINT INTERVAL— 00:00:000:008 




>L5 








;List traced data from 


frame 5. 


FRAME 


ADDRESS 


DATA 


STATUS 


SPARE 


DMA 


FLUSF 


[ 




0005 


OOOOA 


B9EF 


S 


11111010 












0006 


00100 


FFFF 


I 


11000001 








;H5 matched. 


H6 enabled. 


0007 


OOOOC 


0002 


S 


11111010 












0008 


OOOOE 


00A3 


S 


11111010 












0009 


00100 


FFFF 





11110100 








;H6 matched, 


H3 enabled. 


OOOA 


00010 


2D03 


s 


11111010 












OOOB 


00012 


0002 


s 


11111010 












OOOC 


00300 


FFFF 


w 


11111110 












OOOD 


00014 


F8E2 


s 


11111010 












OOOE 


00016 


E8EB 


s 


11111010 












OOOF 


00018 


DBFF 


s 


11111010 












0010 


OOOOE 


00A3 


s 


11111010 





1 






0011 


00010 


2D03 


s 


11111010 












0012 


00012 


0002 


s 


11111010 












0013 


00300 


FFFD 


w 


11111110 








;H3 matched. 




0014 


00014 


F8E2 


s 


11111010 








;* 





* Breakpoints H3 and H4 execute one additional cycle past the final 
address. See timing diagram in Appendix C. 



trigger 
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Example 4: Execute an armed trigger trace using a sequence of three triggers 
and a final breakpoint, i.e. H5— >H6 — >H3 — >H4. 



>J0 
>BTH5 



H6 H3 H4 



; Reset the IP to OOOOH. 

; Settings displayed in Example 1. 



THE TRACE STOPS AT STEP 0029 

INITIAL TRIGGER TO BREAKPOINT INTERVAL— 00:00:000:019 



>L0 FFFF low 



FRAME 
0006 
0009 
OOOC 
0013 
OOIE 
0021 
0024 



ADDRESS 
00100 
00100 
00300 
00300 
00100 
00100 
00300 



DATA 
FFFF 
FFFF 
FFFF 
FFFD 
FFFF 
FFFF 
FFFF 



STATUS 
I 


W 

w 
I 



w 



SPARE 
11000001 
11110100 
11111110 
11111110 
11110001 
11110100 
11111110 



;List all IN PUT/O UTPUT/WRITE cycles 
; between 0-FFFFH, starting at frame 0. 
DMA FLUSH 























;H5 matched, 
;H6 matched. 



H6 
H3 



enabled, 
enabled. 



;H3 count enabled. 



;H4 delay enabled. 



> 



^-7 



3.3 AND Trigger Trace - BT 



BT(A B C)[ D] 
BT(A B)[ C[ D]] 



(A B C)[ D] The AND trigger (breakpoints A, B and C) can be used as a sin- 
gle breakpoint construct, or can serve as a trigger construct 
for breakpoint D. 

(A B)[C [D]] The AND trigger (breakpoints A and B) can be used as a single 
breakpoint construct, or can serve as a trigger construct for 
breakpoint C or for the armed trigger construct of C — >D. 

Breakpoints A-D can be combined In a two or three level AND construct. Armed 
breakpoints can also be specified following the AND trigger. There are up to 
38 different AND trigger combinations. Note that parantheses "( )" must be 
used in the syntax when inputting an AND trigger construct. 
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Example 1: Run a trace with an AND trigger used as a single breakpoint con- 
struct with H4, H5 and H6. (Note that breakpoints specified in an 
AND construct can be matched in any order.) 



>J0 
>H?_ 
Hl= 
H2= 

H3= XXXX FFFF <0> W 2 
H4= 300 FFFF W 5 
H5= 01 
H6= 01 

>BT(H5 H6 H4) 

THE TRACE STOPS AT STEP 0012 
>L5 
FRAME ADDRESS DATA STATUS 
0005 OOOOA 



; Reset the IP to OOOOH. 
; Display H1-H6 settings. 



0006 
0007 
0008 
0009 
OOOA 
OOOB 
OOOC 
OOOD 
OOOE 
OOOF 
0010 
0011 
0012 



00100 

ooooc 

OOOOE 
00100 
00010 
00012 
00300 
00014 
00016 
00018 
OOOOE 
00010 
00012 



B9EF 
FFFF 
0002 
00A3 
FFFF 
2D03 
0002 
FFFF 
F8E2 
E8EB 
DBFF 
00A3 
2D03 
0002 



S 
I 

S 

s 



s 
s 
w 
s 
s 
s 
s 
s 
s 



; Trace with an AND trigger. 

;List traced data from frame 5. 
SPARE DMA FLUSH 
11111010 



11000001 

11111010 

11111010 

11110100 

11111010 

11111010 

11111110 

11111010 

11111010 

11111010 

11111010 

11111010 

11111010 














1 






;H5 matched. 



;H6 matched. 



;H4 matched.* 



* H5, H6 and H4 all matched; breakpoint H4 stops emulation at the next cycle. 



Example 2: Perform a trace using an AND construct as the trigger for an armed 
breakpoint. 



>J0 

>BT(H4 H5 H6) H3 

THE TRACE STOPS AT STEP 0025 

INITIAL TRIGGER TO BREAKPOINT INTERVAL— 00:00:000:017 



; Reset the IP to OOOOH. 
; Execute the trace. 



>L0 FFFF low 



;List all INPUT/OUTPUT/WRITE cycles between 
; OH-FFFFH, starting at frame 0. 



FRAME 


ADDRESS 


DATA 


STATUS 


SPARE 


DMA 


FLUSH 




0006 


00100 


FFFF 


I 


11000001 








;H5 matched. 


0009 


00100 


FFFF 





11110100 








;H6 matched. 


OOOC 


00300 


FFFF 


W 


11111110 








;H4 delay enabled. 


0013 


00300 


FFFD 


w 


11111110 










OOIE 


00100 


FFFF 


I 


11110001 










0021 


00100 


FFFF 





11110100 










0024 


00300 


FFFF 


w 


11111110 








;H3 matched. 



Example 3: Run a trace with an AND trigger and an armed breakpoint sequence. 



>J0 

>BT(H6 H5) H4 H3 

THE TRACE STOPS AT STEP 0025 

INITIAL TRIGGER TO BREAKPOINT 

>L0 FFFF I W 



; Reset the IP to OOOOH. 

;Use an AND trigger and H4 — >H3 as an 

; armed breakpoint. 

INTERVAL— 00 : 00 : 000 : 017 

;List all INPUT/OUTPUT/WRITE cycles between 
; OH-FFFFH, starting at frame 0. 

d. 
d. 
enabled. 



FRAME 


ADDRESS 


DARA 


STATUS 


SPARE 


DMA 


FLUSH 




0006 


00100 


FFFF 


I 


11000001 








;H5 matched. 


0009 


00100 


FFFF 





11110100 








;H6 matched. 


OOOC 


00300 


FFFF 


w 


11111110 








;H4 delay en 


0013 


00300 


FFFD 


w 


11111110 










OOIE 


00100 


FFFF 


I 


11110001 










0021 


00100 


FFFF 





11110100 










0024 
> 


00300 


FFFF 


w 


11111110 








;H3 matched. 
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3.4 OR Trigger Trace - BT 



BT<A B C> 
BT<A B>[ C[ D]] 



<A B C> The OR trigger (breakpoints A, B or C) can be used as a single 
breakpoint construct. 

<A B>[C [D]] The OR trigger (breakpoints A or B) can be used a single 
breakpoint construct, or can serve as a trigger for breakpoint 
C or for the armed trigger construct C — >D. 

Breakpoints A-D can be combined in a two or three level OR construct. Armed 
breakpoints can also be specified after the OR trigger. If an armed trigger 
is used with the OR construct, the ORed pairs must be either data (H3,H4) or 
external breakpoints (H5,H6). There are up to 18 different OR trigger combi- 
nations. Note that angular brackets "< >" must be used in the syntax when 
inputting an OR trigger construct. 

Example 1: Execute a trace using a two level OR construct. 

>J0 ; Reset the IP to OOOOH. 

>BT<H4 H5> ; Execute a trace with data breakpoint pair. 

STOPS AT STEP 0006 

;List all traced data. 



THE TRACE 

FRAME ADDRESS 
0000 00000 



0001 
0002 
0003 
0004 
0005 
0006 



00002 
00004 
00006 
00008 
OOOOA 
00100 



DATA 
9090 
9090 
OOBA 
EDOl 
9090 
B9EF 
FFFF 



STATUS 
S 
S 
S 
S 
S 

s 
I 



SPARE 
11111010 
11111010 
11111010 
11111010 
11111010 
11111010 
11000001 



DMA FLUSH 























;H5 matched. 



Example 2: Execute a trace using an OR construct as the trigger for an armed 
breakpoint. 



>J0 








;R 


esel 


: the 11 


" to OOOOH. 


>BT<H5 H6> H3 






; Execute the 


trace. 


THE TRACE STOPS AT STEP 0014 










INITIAL 


TRIGGER TO BREAKPOINT INTERVAL— 00 : 00 : 000 : 008 


>L5 








;List 


traced 


data from f 


FRAME 


ADDRESS 


DATA 


STATUS 


SPARE 


DL^ 


FLUSH 




0005 


OOOOA 


B9EF 


S ] 


1111010 










0006 


00100 


FFFF 


I ] 


1000001 








;H5 matched. 


0007 


OOOOC 


0002 


S ] 


1111010 










0008 


OOOOE 


00A3 


S ] 


LUllOlO 










0009 


00100 


FFFF 


] 


LlllOlOO 










OOOA 


00010 


2D03 


S ] 


LllllOlO 










OOOB 


00012 


0002 


S ] 


LllllOlO 










OOOC 


00300 


FFFF 


W ] 


LllllllO 










OOOD 


00014 


F8E2 


S ] 


LllllOlO 










OOOE 


00016 


E8EB 


S ] 


LllllOlO 










GOOF 


00018 


DBFF 


s 


LllllOlO 










0010 


OOOOE 


00A3 


s 


LllllOlO 





1 




0011 


00010 


2D03 


s 


LllllOlO 










0012 


00012 


0002 


s 


LllllOlO 










0013 


00300 


FFFD 


w 


LllllllO 








;H3 matched. 


0014 


00014 


F8E2 


s 


LllllOlO 











frame 5. 



Example 3: Run a trace using an OR trigger and an armed brealcpoint sequence. 



>J0 ; Reset the IP to OOOOH. 

>BT<H3 H4> H5 H6 ;Use an OR trigger and an armed breakpoint 

THE TRACE STOPS AT STEP 0021 ; of H5— »H6. 

INITIAL TRIGGER TO BREAKPOINT INTERVAL— 00:00:000:009 



>L0 FFFF low 



;List all INPUT/OUTPUT/WRITE cycles between 
; OH-FFFFH, starting at frame 0. 



FRAME 


ADDRESS 


DATA 


STATUS 


SPARE 


DMA 


FLUSH 




0006 


00100 


FFFF 


I 


11000001 










0009 


00100 


FFFF 





11110100 










OOOC 


00300 


FFFF 


W 


11111110 










0013 


00300 


FFFD 


W 


11111110 








;* 


OOIE 


00100 


FFFF 


I 


11110001 








;H5 matched. 


0021 


00100 


FFFF 





11110100 








;H6 matched. 



* H4 matched at frame 0011, 
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CHAPTER 4 
SYNC SIGNAL OUTPUT 
4.1 External Hardware Trigger Output - BS 



BS l|2[addx[ data[ <dbwc>][ qualifier]]] 



BS 



addx 



data 



<dbwc> 



is the command for External Hardware Trigger Output. 

specifies a positive signal pulse of 140-180ns. (Executing BSl 
clears H3 because the same hardware circuit is used to support 
both of these breakpoints.) 

specifies a positive signal pulse that lasts for the duration of 
the trigger condition. (Executing BS2 clears H4 because the same 
hardware circuit is used to support both of these breakpoints.) 

is the trigger address that causes output of a sync signal. This 
can be an up to six digit hex address with an optional byte pair 
of "XX". (The maximum address length depends on the address range 
of the current emulation processor.) 

is up to 4 digit hex data to be matched with the trigger address. 
(For 8-bit processors, maximum data length is up to 2 hex digits.) 

is an up to 4 digit hex setting indicating a "data bit wildcard". 
(For 8-bit processors, the setting may up to 2 hex digits.) To 
enter any <dbwc>, a data value must first be defined, 
bit wildcard is interpreted as 16 binary data bits, 
indicates "don't care". The default value for the dbwc is FFFFH. 
(For 8-bit processors the default is FFH.) 



The data 
where "0" 



qualifier 



is a single or doulble alphabetic character indicating the type 
of processor activity to be matched with the trigger address. For 
a complete listing of the qualifiers applicable for a particular 
processor, refer to the appendices in the MICE-II User's Guide. 



The BS command can be used to trigger a sync signal to an external device 
(e.g. oscilloscope or logic analyzer). Connection is made on the BPP board 
at BSYNCl (J3-1) or BSYNC2 (J3-2), 

When the specified parameters are matched, a sync signal is transmitted. If 
no other breakpoints are specified before the BS command, emulation will 
continue after the trigger condition is met. To stop emulation before execu- 
tion has been completed, input a Halt command. 
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4.2 Output Signal Timing 



1) BSYNC 1 Output Timing 



71 



■to- 



(fig. 1) 



When the BSl setting is matched, the BPP will issue a positive signal 
pulse as indicated in the figure above. The pulse width of tO = 140-180ns. 

2) BSYNC 2 Output Timing 



tl 



(ng. 2) 

When the BS2 setting is matched, the BPP will issue a positive signal 
pulse as indicated in the figure above. The pulse width of tl is deter- 
mined by the following conditions: 

a) No "wait state" inserted 

Pulse width of tl = duration the trigger condition is matched on the 
bus (which depends on bus timing for the particu- 
lar target system). 

b) "Wait state" inserted 

Pulse width of tl = duration the trigger condition is valid on the 
bus, plus timing for wait state. 
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APPENDIX B 
BPP PLACEMENT CHART 
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APPENDIX C 
TIMING FOR BREAK OPERATION (H1-H6) 



C.l Emulation Status 

MICE-II performs emulation in two different ways, depending on the type of 
processor. 

1) Hold State 

The emulation processor bus is at high impedence whenever it stops. In 
this state all signals on the bus are floating and cannot be tested. Hold 
state is used in MICE-II 8086/88 (MIN/MAX ) , 80186/188, 80286, 6809/6809E, 
68000/10, 68008 and Z80. Also, for the 6809/6809E, emulation always stops 
at the end of instruction execution. 

2) Wait State 

The emulation processor bus is in wait state whenever it stops. In this 
state all signals on the bus are stable and can be tested with a logic 
probe or oscilloscope. Wait state is used in MICE-II 8085, 6502F, NSC800 
and 8048. In wait state, the bus indicates the current address for the 
8085 and NSC800, and the next address for the 6502F and 8048. 

3) Run State 

Whenever program execution stops, the emulation processor is in free-run 
state, executing "JR $" instructions. In this state the signals at the 
Input/Output pins are stable and can be tested, but the signals on the 
Address/Data bus are changing dynamically and cannot be tested. Run state 
is used for MICE-II Z8, ZS8, 8051/8344 and 80515/80535. 

The type of emulation performed determines timing for breakpoint operation. 
The following sections describe break operation for H1-H6. (The examples for 
hold state are based on the 80186, examples for wait state are based on the 
8085 and those for run state are based on the Z8.) 
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C.2 Timing for Breakpoints H1/H2 

1) Hold State 

Emulation stops at the end of the bus cycle* in which the break condition 
is matched; the bus cycle is completed. 



*bus cycle: complete operation of bus activity such as read/write 
from/to memory, or input/output data from/to I/O port. 



data 



Now input a Cycle Step command to display the address of the next cycle 
(i.e. PC+IH for 8-blt and PC+2H for 16-bit systems, assuming no branch 
instruction is executed). Entering an Register command instead of the C 
command at this time may show that the PC does not equal PC+IH or PC+2H, 
though. If the current instruction has not yet been completed, the R com- 
mand will finish it. Therefore, the PC displayed in the R command always 
points to the starting address of next unexecuted instruction; as illu- 
strated by the program segment below. 

ADDRESS DATA STATUS SOURCE CODE 



10008 


9090 


S 


NOP 
NOP 


lOOOA 


BA90 


S 


NOP 

MOV DX,#FF28 


lOOOC 


FF28 


S 




lOOOE 


9090 


S 


NOP 
NOP 



*The break condition (HI or H2) is matched and emulation stops. 

In this example, the break condition is matched and emulation stops at 
the end of the current bus cycle (address lOOOAH). The C command displays 
address lOOOCH, but an R command displays lOOOEH instead. Because the 
first byte (BAH) of the instruction (MOV DX,#FF28) was already fetched 
when emulation stopped, entering an R command completes execution of this 
instruction and displays PC=1000E. (See figure C-1, section C.5.) 
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2) Wait State 

Emulation stops at stable bus state, before the current cycle has been 

completed. (The bus can be tested with a oscilloscope or logic probe at 

this time.) Entering a C command displays the curreat cycle address; but 

inputting an R command instead will display a different address if the 

status of the break cycle is other than S (instruction fetch). This is 
illustrated in the following program segment. 



ADDRESS 


DATA 


STATUS 


SOURCE CODE 


1000 


32 


S 


STA 3000 


1001 


00 


R 




1002 


30 


R 




3000 


AF 


W 




1003 


77 


S 


MOV M,A 



; Break condition 1 
; Break condition 2 



;A=OAF 



Note that no branch instruction is executed in the preceding example. In 
break condition 1, emulation is stopped at an instruction fetch cycle. 
Entering a C or R command displays address lOOOH. In break condition 2, 
however, emulation is stopped at a cycle where bus status is other than 
instruction fetch. Entering a C command displays lOOlH; but inputting an 
R command finishes the instruction and displays PC=1003H. (See figure C-2 
under section C.5.) 



3) Run State 

When the break condition is matched, emulation stops at the end of the 
current instruction. Entering a C command will execute the next instruc- 
tion and then display the current status. However, entering an R command 
will display the current status without causing any instructions to be 
executed. This is illustrated in the following example. 



J)DRESS 


DATA 


STATUS 


SOURCE CODE 




0101 


08 


S 


LD 


R00,R01 




0102 


El 


R 








0103 


56 


S 


AND 


20,#FE 


;* 


0104 


20 


R 






;* 


0105 


FE 


R 






;* 


0106 


38 


S 


LD 


R03,20 




0107 


20 


R 








0108 


FF 


S 


NOP 







* The specified break condition (HI or H2) may be matched at any cycle of 
this instruction. 

Entering a C command will execute the next instruction at address 0106H- 
0107H and then display the current status; but entering the R command 
instead will simply display the current status, where the PC=0106H. (See 
figure C-3, section C.5.) 
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C.3 Timing for Breakpoints H3/H4 

The comparison operation for data breakpoints takes too long for emulation 
to be stopped at the current cycle. Also note that executing the C or R com- 
mand after emulation has been stopped by H3 or H4 produces the same results 
as described above for H1/H2. 

1) Hold State 

When the break condition is matched, emulation stops at the end of the 
next bus cycle. (See figure C-1, section C.5.) 

2) Wait State 

When the break condition is matched, emulation stops at stable bus state 
for the next cycle. (See figure C-2, section C.5.) 

3) Run State 

When the break condition is matched, emulation stops at the end of the 
current instruction. However, if it is matched at the last cycle of an 
instruction; emulation will stop at the end of the next instruction. (See 
figure C-4, section C,5.) 



(-'_'; 



C.4 Timing for Breakpoints H5/H6 

1) Hold State 

When H5 or H6 is matched, a signal is immediately (appx. 100ns) generated 
by MICE to stop emulation. Therefore, if the trigger occurs "early enough" 
in a bus cycle (e.g. before T2 for 8086), emulation will stop at the end 
of the current cycle (same as H1/H2); but if the trigger occurs "too 
late" (e.g. after T2 for 8086), then emulation will stop at the end of 
the next cycle (same as H3/H4). 

2) Wait State 

When H5 or H6 is matched, a signal is immediately (appx. 100ns) generated 
by MICE to stop emulation at stable bus state. Therefore, if the trigger 
occurs "early enough" in a bus cycle (e.g. before T2 for 8085), emulation 
will stop at valid state for the current cycle; but if the trigger occurs 
"too late" (e.g. after T2 for 8085), then emulation will stop at valid 
state for the next cycle. 

3) Run State 

When H5 or H6 is matched, a signal is immediately (appx. 100ns) generated 
by MICE to stop emulation. Therefore, if the tri gger occurs "early enough" 
(i.e. anywhere before the rising edge of DS or MDS* for Z8/ZS8 or the 
rising edge of ALE for 8051/8344, during the last cycle of an instruc- 
tion), emulation will stop at the end of the current instruction; bu t if 
the trigger occurs "too late" (i.e. after the rising edge of DS or MDS 
for Z8/ZS8 or the rising edge of ALE for 8051/8344, during the last cycle 
of an instruction), then emulation will stop at the end of the next in- 
struction. 

* MDS indicates internal program memory data strobe. This signal is out- 
put from the emulation CPU. 

The break position for the emulation states described above is determined by 
the timing of H5/H6 and by the specific point in cycle execution that can be 
defined as "early enough" or "too late" (which depends on the type of emula- 
tion processor used, refer to section C.6). 
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C.5 Timing Diagrams for Break Operation 

The following diagrams show the timing of break condition match and emula- 
tion halt during bus cycle execution. 



1) Hold State 



transition 
state ^ 



bus cycle 



stable 
state 



bus cycle PC 



xrpK 



bus cycle PC+2 



)<IZ3< 



bus cycle PC +4 



bus cycle 



S 
PC 



break condition i 
matched in this 
cycle 

CPU is held CPU is held 

at Uiis at this 

point for HI. H2 POint for H3, H4 

Figure C-1 Hold State Timing Diagram 

is fetch state. (No I/O or R/W operation, or branch in- 
struction is assumed in this example.) 

is the program counter. (The increment per bus cycle is 
PC=PC+1 for 8-bit microprocessors and PC=PC+2 for 16-bit 
microprocessors . ) 



stable state is a full bus cycle. 

transition state is the end of a bus cycle and the start of the next one. 

For 16-bit processors (e.g. 8086/88, 80186/188, 80286 68000/10, 68008), once 
emulation stops, prefetch instructions already in the queue are executed. 
Note that prefetched instructions requiring external bus cycles* are not 
executed , though . 

*External bus cycles access external peripherals (eg. memory, I/O port, etc.) 
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2) Wait State 

There are 4 bus cycles illustrated in the following diagram. (Note that 
this diagram is applicable for the Wait State example under section C.2.) 



transition 
state 



stable 
state 

bys cycle PC 



bus 
bus cycle PC+I bus cycle PC+2 cycle 



3c:ezx^i:zx:zzx 



w 



Read , . , , , . , , 

signal ft t 

Break condition CPU held in CPU held in 

matched in WAIT at this WAIT at this 

this cycle point by HI or H2. point by H3 or H4. 

Figure C-2 Wait State Timing Diagram 

S is an opcode fetch cycle (i.e. the 1st byte of an instruc- 

tion; no branch instruction is assumed in this example). 

R is a memory read cycle or the subsequent byte read for an 

instruction. 

W is a memory write cycle. 

PC is the program counter. (The increment per bus cycle is 

PC=PC+1; the PC is 1000 in this example.) 

stable state is a full bus cycle. 

transition state is end of a bus cycle and start of the next one. 
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3) Run State 
a) H1/H2 



Transition _^ 
state 



Stable 
state 



bus 
cycle 



PC 



PC+l PC+2 



PC+3 PCM PC+3 



PC+4 PC+3 



xzx 



Data 
strobe 




Break condition CPU held in execution by 
matched in this 'JR $' instruction at 
cycle this location 

Figure C-3 Run State Timing Diagram for H1/H2 



b) H3/H4 



PC PC+l PC-H2 PC+3 PC+-4 PC+3 PC+A PC+3 

ZXIXIXIXlXI3GDCC>CI 



Break condition 
matched in this 
cycle 



CPU held in execution by 
'JR $' instruction at 
this location 



PC PC+l PC+2 PC+3 PC+4 PC+5 PC+A PC+5 




Break condition CPU held in execution by 
matched in this 'JR $' instruction at 
cycle this location 

Figure C-4 Run State Timing Diagram for H3/H4 



r_Q 



If execution is stopped by H3/H4, the the program counter will equal the 
halt address plus one instruction. However, if the halt address is at the 
last cycle of an instruction, the program counter will equal the halt 
address plus two instructions. 

S is an opcode fetch cycle (i.e. 1st byte of an instruc- 

tion; no branch instruction is assumed in this example). 

R is a memory read cycle for an instruction. 

PC is the program counter. (The increment per bus cycle is 

PC=PC+1 . ) 

stable state is a full bus cycle. 

transition state is end of a bus cycle and start of the next one. 
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C.6 Breakpoint Timing (H5/H6) for Respective MICE-II 



mcE-ii 


Break flatch Timing 
miniimiti Value (tBFTS) 


Stop CPU Setup Time 
ninumin Value 


Emulation Processor 




CIHz 


6502F 


321.2ns + tPCS 


tPCS = * 






6809/6B09E 


207.5ns + tPCS 


tPCS = 2D0ns 
140ns 
110ns 


5809/Ba09E 

58A09/6BA09E 

SBBOg/SBBOOE 


a 
a 

8 


8085 


202ns + tRYS 


tRYS = 110ns 
IIDns 
100ns 


B085A 

BOaSAH 

8085AH-Z 


6 

6 

10 


8QBS/8a(raN) 


235.6ns + tHUCH 


tHVCH = 35ns 
20ns 


B086/88 
8086/88 -2 


5 
8 


808B/88{mAX) 


210.5ns + tRYHCH 


tRYHCH = nans 
BBns 


8086/88 
8086/88 -2 


5 
8 


68000/010 


234.3ns + tASI 


tASI = 20ns 


68000/01 


S/10/12.5 


68008 


243.5ns + tASI 


tASI = 2Dns 


68008 


8/10/12.5 


801 86/1 88 


202.2ns + tHVCL 


tHVCL = 25ns 


80186/188 


6/B 


80286 


244.8ns + tHVa 


tHUCL = 30ns 
20ns 


80286-6 
80286-8/1 


6 
8/10 


NSCBDD 


202ns + tlUS 


tills = 5Qns 
100ns 

35ns 


NSC800 

NSC800-1 

NSC800-4 


5 
2 
8 


Z80 WAIT rtode 


249.8ns + Tsui 


Tsui = 70ns 
70ns 
60ns 
50ns 


Z80 

Z80A 

Z80B 

zaoH 


2.5 
4 

6 
8 




209.2ns + Tsb 


Tsb = aOns 
5Dns 
5Dns 
40ns 


Z80 
Z80A 
Z80B 
Z80H 


2.5 
4 
6 
8 


ZaO BUSAK mode 


3048 


188.5ns 




8048 


11 


3051/3344 


215.4ns 




BDC51VS 


12 


80515/80535 


laSns + TUIHLH 




B0515-E-A 


12 


za 


■237ns 




Z8612 


12 


zsa 


22Qns 




za8a3 


20 
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6502 
family 


G65SC10X 


G65SC0X 
G65SC1X 
G65SC11X 


R65C02 

R65C102 

R65C112 


R650X 
R651X 


MHz 


tPCS = 


100ns 


200ns 




100ns 


1 


50ns 


200ns 


110ns 


50ns 


2 


35ns 


150ns 


80ns 


35ns 


3 


25ns 


120ns 


60ns 




4 



1) 6502F 



$2: 



J \_^J 



Break Not \J' 

Condition M atched A ^"^g^k Matched 



STOP 



tBMS 



v 



2) 6809/6809E 



Break Not 
Condition Matched 



STOP 



J V_^ \. 



A 



rT\ / 



Break Hatched 



-tBMS- 



\ 



C-12 



3) 8085 



Tl 



"^\_/ V 



Break Not 
Condition Matched 



ched/ N 



STOP 



Break Matched 



tBMS 



-v 



^^ /~^v_^^^ 



T2 T WAIT 

v 



4) 8086/88(MIN) 



L Tl -4— T2 -J- T3 -4— T4 -H 



CLK 



Break Not \j 
Condition Matched/* 



Break Matched 



-tBMS ► 



STOP 



V. 



5) 8086/88(MAX) 



CLK 



Break Not 
Condition Matched . 




Break Matched 



tBMS 



STOP 



n_n 



6) 68000/10 & 68008 



so SI S2 S3 _S4 



CLK 



Break 
Condition 



STOP 



Not Matched 



><. 



S5 S6 S7 



Break Matched 



tBMS ■ 



7) 80186/188 



CLK 
From 

CPU 



I T2,T3 J^T3 or Tw-^ T4 -[► Ti 



Break Not V 

Condition Mat ched / \ 



STOP 




8) 80286 



CLK 



Break 
Condition 



STOP 



_rm 



I 



01 02 01 



^^f\r^j~'j^' 



MATCHED 



tBMS 



02 



Tc 



Ti 



K. 
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9) NSC800 



CLK 

Break 
Condition_ 

STOP " 



-Tl » 



T2 



\_jr\^~~^ 



Not Hatched 



} 



Break Matched 



tBMS 



\ 



10) Z80 WAIT Mode 

WAIT Mode 
CLK 



Tl T2 Tw Tw Tw 



Break N 
Condition Hatched 



STOP 




Break Matched 



11) Z80 BUSAK Mode 



BUSAK Mode 



aK 



Last state Tx Tx Tx 



Break }fot 
Condition Hat ched I 



STOP 
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12) 8048 



ALE 
(From CPU) 



^^ 



Break ,, „ , ^ 
Condition ""t Matched 



STOP 



Break Matched 



tBMS 



A 



1-cycle instruction: If timing is within the specified parameters, emu- 
lation will stop at the next instruction cycle; 
otherwise the next instuction will be completed. 



2-cycle instruction: 



13) 8051/8344 



If timing is within the specified parameters for 
either cycle, emulation will stop at the next in- 
struction cycle; otherwise the next instruction 
will be completed. 



AT P 


/ 


1 




i 


"^ 








Break 
Condition 


Not 
Matched 




J 


Break 
Matched 










STOP 








-tBMS- 


L 







Note 



: Emula tion will stop at the end of the current instruction, where 
STOP means that the CPU will be executing "SJMP $" instructions. 
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14) 80515/80535 



ALE 



Break 
Condition 



STOP 



r^ 



Not Matched 



Break 
Matched 



-i-tBMS— 
\ 
(185ns + TWHLH*) 



* TWHLH is WR or RD to ALE high. (Refer to AC Characteristics, page 202, 
Seiraens Microcomputer Components, SAB 80515/80535 Single-Chip Micro- 
controller User's Manual, 7/85). 

Note: Emula tion will stop at the end of the current instruction, where 
STOP means that the CPU will be executing "SJMP $" instructions. 

15) Z8 & ZS8 



DS or MDS 



Break 
Condition 



STOP 





\ 


1 








Not matchedA 


Break Hatch 












\ 

















Note: Emula tion will stop at the end of the current instruction, where 
STOP means that the CPU will be executing "JR $" instructions. 
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